Cookie Banner Rules in Greece (2026): A Practical SME Guide

If your business website is visible to people in Greece and uses Google Analytics, an advertising pixel, embedded videos or chat widgets, you need the visitor’s consent before those trackers load. Under the Hellenic Data Protection Authority’s (HDPA) guidance, the cookie banner must offer Reject as easily as Accept, on the first layer and with buttons of equal weight. Cookie walls, pre-ticked boxes and “consent by scrolling” are not allowed. This guide turns the rules into a practical checklist for small businesses.

This is general information, not legal advice. For your specific setup, check with a data protection lawyer or adviser in Greece.

Which law applies to cookies in Greece?

Cookies are not governed by the GDPR alone. The core rule is Article 4(5) of Law 3471/2006, which transposes Article 5(3) of the EU ePrivacy Directive (2002/58/EC). It says that storing information on a user’s device, or reading information already stored there, is only allowed with consent after clear and comprehensive information. The GDPR then defines what valid consent means: freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

Two consequences matter for small businesses:

• The rule applies whether or not the data is personal. The EU Court of Justice confirmed this in the Planet49 case (C-673/17, 2019), which also ruled that a pre-ticked checkbox is not valid consent.
• It is not only about cookies. The European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3) cover tracking pixels, tracked links, local storage and other identifiers too. A site that sets no cookies but loads an ad pixel is still in scope.

What needs consent and what does not

A point many site owners miss: the HDPA’s Recommendations 1/2020 name Google Analytics explicitly as a third-party analytics tool that may only be used with the user’s consent. There is currently no general “statistics exemption” in Greece.

The HDPA’s rules for cookie banners

The HDPA published its guidance on cookies and trackers on 25 February 2020 after auditing popular Greek websites. In practice it boils down to these rules:

1. Consent requires a clear positive action. Pre-ticked boxes, continued browsing and scrolling are not consent.
2. Browser settings that accept cookies by default are not consent.
3. If the user makes no choice, no non-essential tracker may be used.
4. Accepting and rejecting must be possible with the same number of clicks and from the same level, either for all trackers or per category.
5. Withdrawing consent must be as easy as giving it.
6. Rejecting must not block access to the content (no cookie walls).
7. Accept and Reject buttons should have the same size, tone and colour, so the design does not push users towards Accept.
8. The banner should reappear after the same interval whether the user accepted or rejected.

These points match the common position of European regulators. The EDPB’s Cookie Banner Taskforce report (January 2023) also found that most authorities consider a banner with “Accept” but no “Reject” on the first layer to be non-compliant, and that legitimate interest cannot replace consent for non-essential cookies.

How the HDPA enforces it

The HDPA has acted on banners mainly through audits and warnings so far. In a 2022 press release it said that several informational websites showed “I agree” and “More options” on the first layer with no “Reject” option, and that “I agree” was highlighted in a colour that encouraged acceptance. It invited all websites to comply with Recommendations 1/2020 as soon as possible and stated that it can impose administrative penalties for non-compliance.

The practical risk for a small business is less a headline fine and more a complaint, an audit and the time it takes to fix a setup under pressure. A non-compliant banner is also often a sign that analytics and ad data are being collected without a lawful basis, which undermines the data you rely on for marketing decisions.

Step-by-step: make your banner compliant

1. Inventory your trackers. Open your site in a private window, use the browser’s developer tools and list every cookie, local storage entry and third-party request that fires before you click anything.
2. Classify each one as strictly necessary or not. When in doubt, treat it as needing consent.
3. Block non-essential tags until consent. Use a consent management platform (CMP) or your tag manager’s consent settings so analytics, pixels and embeds only load after the user agrees.
4. Design the first layer correctly: “Accept all” and “Reject all” side by side, same size and colour, plus a “Settings” option for categories.
5. Write clear information in Greek (and English if you serve tourists or international customers): what each category does, who the third parties are and how long data is kept.
6. Add a permanent way to change consent, such as a footer link or small icon, so withdrawal is as easy as giving consent.
7. Keep proof of consent. Under GDPR Article 7(1) you must be able to demonstrate consent, so make sure your CMP logs choices.
8. Re-test after every change to your site, theme or plugins, because new embeds often add trackers silently.

Once consent is in place, your analytics will only count visitors who accept, so your reports will change. If you need help rebuilding measurement around consent, our Analytics & Reporting Setup and Digital Performance Audit are designed for small businesses. For the wider picture of reliable reporting, see setting up a marketing analytics dashboard.

What could change: the EU Digital Omnibus

On 19 November 2025 the European Commission proposed the Digital Omnibus, which would move the cookie rule into the GDPR as a new Article 88a. The proposal includes a consent exemption for limited first-party audience measurement, single-click refusal, and a limit on how often sites may ask again after a refusal. EU member states agreed the Council’s negotiating mandate on 21 October 2026, but the European Parliament still has to adopt its position before negotiations start.

It is a proposal, not law. Until it is adopted and applies, Law 3471/2006 and the HDPA’s 2020 recommendations remain the rules for Greek websites. You can compare how another regulator applies the same EU framework in our guide to cookie banner rules in the Netherlands.

Common mistakes

• “Accept” plus “Settings” but no “Reject” on the first layer.
• A bright Accept button and a grey text link for Reject.
• Loading Google Analytics or the Meta pixel before any click, often hard-coded in the theme rather than routed through the CMP.
• Treating closing the banner (X) as consent.
• Relying on “legitimate interest” toggles for advertising or analytics cookies.
• An outdated cookie policy that does not list the trackers your site actually uses.
• No record of consent, so you cannot prove it if asked.

FAQ

Does Google Analytics need consent in Greece?

Yes. The HDPA’s Recommendations 1/2020 explicitly say third-party analytics tools such as Google Analytics may only be used with consent.

Can I block content until visitors accept cookies?

No. The HDPA says refusing trackers must not restrict access to the website’s content.

Do I need a banner if I only use strictly necessary cookies?

You do not need consent for strictly necessary cookies, but you still need to inform users about them, typically in your privacy or cookie policy.

Does this apply if my business is outside Greece?

If you target users in Greece, Greek and EU rules can apply. Other EU countries apply the same ePrivacy rule with similar guidance, so a banner that meets the HDPA’s standard is usually a safe baseline across the EU.

Conclusion

Cookie compliance in Greece comes down to a technical setup more than legal wording: nothing non-essential loads before consent, Reject is as easy as Accept, content stays open to everyone and you can prove what each visitor chose. The rules have been clear since 2020 and still apply in 2026 while the Digital Omnibus is negotiated. Audit your site, fix the first layer of your banner and rebuild your analytics around consented data.

Sources

• Hellenic DPA: Action on informational websites’ cookies (press release)
• Hellenic DPA: Recommendations 1/2020 on cookies and trackers (in Greek)
• Hellenic DPA: Legal framework (Law 3471/2006)
• EDPB: Report of the Cookie Banner Taskforce (2023)
• MS-Logic: GDPR and cookies in 2026, the rules in Greece (updated October 2026)
• Cuatrecasas: Digital Omnibus, EU Council establishes position (October 2026)