Websites for Turkish Lawyers: .av.tr, Professional Rules and Secure Contact

A website for a Turkish legal practice should help visitors identify the correct office, find its contact details and access information that the practice has approved for publication. An impressive homepage cannot compensate for a domain owned through a developer’s personal account or a document stored behind a publicly accessible link. Start with two questions: can a visitor identify the office correctly, and do we know where information goes during first contact?

1. Establish the professional boundaries before designing the website

The Union of Turkish Bar Associations’ Advertising Prohibition Regulation, Article 7(d), addresses identity information and practice areas without implying specialisation; client references are prohibited. Article 7(e) restricts competitive, work-seeking search-engine methods and online advertising. The former internet provision, Article 9, was repealed in 2024. Review the domain, visible copy and code together using the current text.

This article appears on TankDev’s website and explains our software service. Copying its package comparison or software enquiry invitation directly onto a lawyer’s own website would be an inappropriate project shortcut. First establish the information the practice has approved for publication. Then agree its presentation, access model and operation. A component being available in a template does not establish that it is suitable for this professional use.

• Provide approved office and lawyer identity, contact details and a publication inventory before design starts.
• Name the content approver, changes requiring renewed review and the person authorised to withdraw a page.
• Do not treat automated publication of profiles, content or links on external platforms as an assumed deliverable.

2. What is .av.tr, who can obtain it and how does allocation work?

.av.tr is allocated through a documented process. TRABİS lists lawyers, law offices and lawyer partnerships as eligible applicants. An individual needs current bar-issued evidence of lawyer status or a notarised copy; an office or partnership needs this for each lawyer. A representative also needs evidence of authority. Applications go through a chosen registrar to TRABİS for review, which can lead to additional-document requests, approval or a reasoned refusal.

The TBB domain notice explains that the former TBB approval-form and ODTÜ Nic.tr approval-letter procedure is no longer used. Avoid following an old online guide to the wrong application channel. Confirm the current registrar, document format, requested domain name and renewal conditions before applying. We do not promise a fixed allocation time, price or guaranteed approval.

Allocation of a domain is not approval of everything published on the website. Do not present .av.tr alone as a quality certificate, an assurance about a case outcome or a mechanism that guarantees a higher Google ranking. Manage domain eligibility and the practice’s content review as separate work items.

3. Plan the website and email together when moving to .av.tr

Consider an illustrative migration: the practice has used an old domain for email for years and wants to move its website to a newly allocated .av.tr address. Launching the new website and cancelling the old domain can disrupt correspondence and saved links. Inventory existing pages and mail flows first. Agree which domain will be the primary web address and which addresses will continue to handle email.

• Map important old pages to equivalent new pages using permanent redirects rather than sending every request indiscriminately to the homepage.
• Verify HTTPS coverage, canonical URLs, language alternates and sitemap entries for the new domain.
• Review MX records and SPF/DKIM/DMARC with the mail provider; do not delete email records while publishing a website.
• Assign a clear owner and period for old-domain renewal and handling mail sent to old addresses.
• Test old links, new pages, form notifications and actual two-way email after the change.

Knowing who controls DNS matters beyond launch day. Recovery messages going to a former employee or an expired payment card can leave the practice unreachable. Complete secure account handover and document ownership instead of putting passwords in a plaintext delivery file. Record how the practice can recover access if the developer becomes unavailable.

4. Derive the page structure from an approved information inventory

Consider a restrained structure covering the homepage, approved office/lawyer information, approved practice-area information, contact details and necessary data-processing notices. Assign an owner to every page. Instead of generating dozens of near-identical city or subject pages, examine where visitors struggle to find the approved information. Page count alone is not a useful measure of delivery quality.

For a bilingual website, English copy is a separate publication decision. A translation should not imply a different professional qualification or authority to practise in another country. Manage office addresses, lawyer details and contact channels from a consistent record. Unreviewed translations should not publish automatically, and the language switch should lead to the corresponding page rather than a generic homepage.

A content-management panel needs more than a publish button. Draft, awaiting-review, approved and withdrawn states, revision history and rollback make controlled publication practical. When a lawyer leaves the office, a defined update workflow can identify the pages and structured data that need revision. Otherwise, a current biography and an obsolete machine-readable identity can coexist unnoticed.

5. Separate first contact from confidential document intake

Do not make a public contact form the default collection point for an entire case file. Our suggested starting design collects limited information needed for a reply. National identity numbers, medical documents, case papers and extensive factual narratives are not default fields. The practice decides what is necessary. A large free-text box can encourage visitors to disclose sensitive details that the office has not requested.

Design first contact and detailed document review as separate workflows. After the practice has completed its necessary human assessment, it can invite a person into a restricted channel where needed. Bind that invitation to a recipient, a validity period and defined permissions. A client area is not complete until cross-user access has been tested, including attempts to access another person’s documents.

Refreshing a page should not create duplicate records. A temporary notification-provider failure should not silently lose a message already saved by the server. A submission key, record-status lookup and failed-notification queue can address these engineering problems. They are not legal deadline calculation or automated engagement features. Our API and system integration guide discusses the engineering of permissions and failure handling.

6. KVKK: a privacy notice is not a universal consent checkbox

The KVKK announcement concerning principle decision 2026/347 of 18 February 2026 emphasises separating privacy information from explicit consent. It also explains that an additional explicit-consent text should not be presented where processing relies on another statutory condition. Do not treat a mandatory “I accept KVKK” box as a ready-made solution. The practice determines the purpose and legal basis; the interface should reflect them accurately.

Before implementation, build a data-flow inventory: field, destination system, authorised people, external service, retention period and deletion owner. Include email, error monitoring, backup and analytics providers. Hosting a server in Turkey does not by itself localise data sent to another service. The practice must assess providers and potential transfers; the software team should make actual data flows visible instead of assuming them away.

Do not reduce the possibility of special-category data to a form label. Messages do not all contain the same types of information; the practice needs to identify what it processes. Start the engineering work by keeping form content out of analytics events, URL queries and error-monitoring dashboards. Measuring that a form was submitted does not require sending the message body to a measurement provider.

7. Design permissions, audit records and recovery together

KVKK’s data-security guidance addresses technical and organisational measures together. The following is our implementation checklist, not a compliance certificate. HTTPS alone does not explain document permissions, staff access or backup protection.

• Use individual administrative accounts, multi-factor authentication and role-limited permissions; revoke access when someone leaves.
• Keep private documents outside public folders. An unpredictable filename is not authorisation: check access on every download.
• If uploads are included, scope size/type limits, quarantine and malicious-file inspection; do not trust the filename extension alone.
• Keep necessary audit information without writing document contents or passwords into application logs.
• Restrict backup access and perform restore exercises. Address the possibility of deleted data returning from a backup in the retention and disposal plan.

Keeping a page out of search results and securing access are different jobs. Adding noindex to a private document URL does not stop someone who knows the link. Apply access controls in the application and storage layers. Similarly, a separate staging subdomain is not sufficient isolation: decide how to restrict access and avoid using real case documents in testing.

8. Define technical publishing checks and structured data precisely

Do not write acceptance criteria for this project as a promise that the office will rank first. Our suggested technical checks ask whether an approved page opens at the correct URL, the canonical points to the intended domain, Turkish/English pairs are consistent, private pages stay out of the public sitemap and information is readable on mobile. Professional review of content and code remains a separate requirement.

Schema.org LegalService is a vocabulary type for an organisation providing legal services. If used, it should match approved information visible on the website. The existence of a schema property is no reason to invent a rating, review, price, success rate or professional claim. This guide does not publish an imaginary law office as a real JSON-LD entity: TankDev is the publisher of the article.

Our technical SEO/GEO guide explains crawl, URL and language errors. General business-growth recommendations do not automatically carry over to a Turkish legal practice. Naming the permitted technical checks and excluded methods in the development scope is more useful than an undefined promise that “SEO is included”.

9. Distinguish accurate AI information from a recommendation promise

An assistant associating an office with the wrong lawyer or showing an obsolete address is an information-accuracy problem. Reviewing the consistency of approved identity information can help investigate it. That does not mean the assistant will recommend the practice or generate new work. TankDev does not control assistants’ source selection.

Adding an online assistant is also a separate product decision. We do not assume that an automation sending case narratives and documents to a public model belongs in a standard website package. A restrained starting point may consider approved responses to limited questions such as contact information; case-specific interpretation, deadline calculations and engagement acceptance are not automated. Human handover, data flows and access boundaries need to be defined before an integration is enabled.

Our Google and AI visibility guide explains the difference between accessible source material and being recommended. For a legal practice, this technical explanation is not permission to disregard professional restrictions.

10. TankDev website packages for legal practices: scope and boundaries

TankDev develops custom-coded, mobile-friendly websites for legal practices. The comparison below describes the starting framework for our software offer. Work considered appropriate after professional review must be specified in the contract. Buying a package does not buy bar approval, a KVKK compliance certificate or legal review of the content.

Compare current package features. The Turkish offer starts at TRY 50,000 for Essential and TRY 150,000 for Advanced; these are separate market offers, not currency conversions. A case-management system, UYAP connection, payment system or client portal is not automatically included. Integration requires verified provider permissions and a decision by the practice before delivery can be promised.

11. Accept working workflows rather than visitor-count promises

In an illustrative acceptance exercise, submit a test message from a mobile device, temporarily disable the notification provider and confirm that an authorised person can still find the saved record. Then attempt to access it with an unauthorised user and verify rejection. Finally, restore sample data from a backup. This gives stronger evidence than checking that a form displayed a green success message. Use test data rather than real case files.

• Domain and mail: ownership, renewal, DNS rollback and two-way email testing.
• Content: practice approval, bilingual identity consistency, outdated-information correction and rollback.
• Contact: validation, repeated submission, separation of recording from notification and accurate receipt text.
• Private area if included: cross-user access, link expiry, permission revocation and upload quarantine.
• Operations: update ownership, restore exercises, incident reporting and revocation of support access.

When discussing scope with TankDev, provide your domain, email provider, approved page inventory and actual first-contact workflow; real client files are unnecessary. Describe your legal-practice website requirements. Start with a manageable foundation. Add a private document area or integration only when its need, responsibilities and access model are clear.

Sources and scope

Sources and package fields were checked on 8 November 2026. Migration and acceptance scenarios are illustrative, not accounts of real practices or clients. This guide concerns Turkey. Assess current primary sources alongside the proposed use; technical delivery does not guarantee professional compliance.

• TBB — Current Advertising Prohibition Regulation
• TRABİS — Documented domain allocation
• TBB — .av.tr application notice
• KVKK — Principle decision 2026/347 announcement
• KVKK — Data-security duties
• Schema.org — LegalService