Cookie consent in Greece: what Law 3471/2006 requires

Which Greek law regulates cookies?

Greece transposes the ePrivacy Directive in Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector. The cookie rule is Article 4(5), which Article 170 of Law 4070/2012 replaced to implement the 2009 amendment of the Directive.

Article 4(5) says that storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user is allowed only if that person has given consent after clear and detailed information. Three more points follow in the same paragraph:

1. Consent can be given through appropriate settings of the web browser or another application.
2. The rule does not prevent technical storage or access whose sole purpose is to transmit information over an electronic communications network, or that is necessary to provide an information society service the user or subscriber explicitly requested.
3. The HDPA defines in detail how information is provided and consent is given.

Consent is read with the GDPR standard: freely given, specific, informed, unambiguous and by a clear affirmative action.

Do browser settings count as consent in Greece?

The text allows it, but the HDPA reads the clause narrowly. Its guidance says browser settings can give valid consent only if the browser asks for consent for each cookie. Accepting cookies through the browser's default settings is not consent. A browser that rejects third-party cookies by default and requires an active choice to accept them can give valid consent; a browser that accepts everything until the user switches it off cannot. In practice, every Greek site needs its own consent mechanism.

Which cookies are exempt?

The HDPA lists the cookies that fall within the exemption: session cookies needed to keep what the user enters, such as a form or a shopping cart; authentication cookies for services that require login; security cookies, such as those that detect repeated failed login attempts; load balancing cookies; and cookies that remember the user's display choices, such as language.

Analytics cookies are not exempt, even when they serve only to measure traffic. The HDPA states that third-party analytics such as Google Analytics may be used only after the user consents. Its guidance adds that the European authorities recognize the lower risk of first-party analytics cookies set by the site itself, and that in that case it is enough to offer the user a way to opt out. Third-party analytics and all advertising cookies need prior consent.

What must a Greek cookie banner do?

The HDPA's Guidelines 1/2020 set out compliance points for websites. Its press release of 9 May 2022 quotes two of them:

• C4: the user must be able, with the same number of actions (clicks) and from the same level, either to accept the trackers that need consent or to reject them, all at once or by category.
• C7: to avoid steering users toward acceptance, the buttons should use the same size, highlighting, color and font, with the same readability.

The HDPA's general guidance adds that the information must be visible and specific to each case, explaining the purposes of the cookies used, and that a general mention in the terms of use or a long privacy policy is not enough. Users must be able to withdraw consent the same way they gave it and change their preferences while browsing. A banner that nudges users toward accepting is considered insufficient. The Reject all guide covers the design.

Who enforces cookie rules in Greece?

Article 13 of Law 3471/2006 makes the Hellenic Data Protection Authority competent to apply the law, alongside the Hellenic Authority for Communication Security and Privacy (ADAE), which deals with network security and confidentiality. Cookies on websites are an HDPA matter. The HDPA also enforces the GDPR.

On 9 May 2022, the HDPA announced an ex officio audit of 30 news and information websites chosen by traffic. Their banners showed "I agree" and "More options" on the first level, with no reject option, and highlighted the agree button in a color that prompted its selection. The HDPA gave the sites 15 days to comply. All but one did. The HDPA warned that it can impose administrative penalties when sites do not comply.

How high are the fines in Greece?

For breaches within its jurisdiction, Article 13(4) of Law 3471/2006 lets the HDPA impose the administrative penalties provided by Article 21 of Law 2472/1997, the former data protection act. That act has been largely repealed by Law 4624/2019, which leaves the exact range for a pure cookie breach uncertain, so we do not quote one. When cookies process personal data, the HDPA can also apply the GDPR, with fines up to 20 million euros or 4% of worldwide annual turnover. Article 14 adds civil liability: compensation for non-pecuniary damage caused by a breach of the law is set at no less than 10,000 euros, unless the claimant asks for less.

We found no published HDPA fine for cookies alone as of October 2026. The 2022 action ended in compliance rather than penalties.

Does the banner have to be in Greek?

We found no rule that sets the language of a cookie banner specifically. The HDPA requires information that is visible, specific and clear, so a site aimed at Greek visitors should present its banner in Greek.

How Cookiequiet fits

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default with the same size and color, which is what points C4 and C7 describe, and the banner is shown in Greek to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting is included on every plan, including Free. Check your site with the cookie scanner first.