# Cookie consent in Greece: what Law 3471/2006 requires

> In Greece, storing or reading information on a user's device is allowed only if the user consents after clear and detailed information, under Article 4(5) of Law 3471/2006 as amended in 2012. The Hellenic Data Protection Authority (HDPA) enforces the rule, and its Guidelines 1/2020 require that visitors can reject trackers from the same level and with the same number of clicks as accepting them. In 2022 it ordered 30 high-traffic news sites to fix their banners within 15 days.

Source: https://cookiequiet.com/laws/greece
Published: 2026-10-21
Publisher: Cookiequiet

## Quick facts

- **Applies to:** Anyone who stores or reads information on the terminal equipment of a subscriber or user in Greece: websites, apps, ad and analytics providers
- **Consent model:** Opt-in after clear and detailed information; browser settings count only in narrow cases set by the HDPA
- **Cookie rule:** Article 4(5) of Law 3471/2006, as replaced by Article 170 of Law 4070/2012
- **Authority:** Hellenic Data Protection Authority (HDPA), under Article 13 of Law 3471/2006
- **Maximum fine:** Administrative penalties via Article 13(4) of Law 3471/2006; GDPR fines up to 20 million euros or 4% of worldwide turnover
- **Key guidance:** HDPA Guidelines 1/2020 on the use of trackers, with compliance points C1 to C7

## Which Greek law regulates cookies?

Greece transposes the [ePrivacy Directive](/laws/eprivacy-directive) in Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector. The cookie rule is Article 4(5), which Article 170 of Law 4070/2012 replaced to implement the 2009 amendment of the Directive.

Article 4(5) says that storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user is allowed only if that person has given consent after clear and detailed information. Three more points follow in the same paragraph:

1. Consent can be given through appropriate settings of the web browser or another application.
2. The rule does not prevent technical storage or access whose sole purpose is to transmit information over an electronic communications network, or that is necessary to provide an information society service the user or subscriber explicitly requested.
3. The HDPA defines in detail how information is provided and consent is given.

Consent is read with the [GDPR](/laws/gdpr) standard: freely given, specific, informed, unambiguous and by a clear affirmative action.

## Do browser settings count as consent in Greece?

The text allows it, but the HDPA reads the clause narrowly. Its guidance says browser settings can give valid consent only if the browser asks for consent for each cookie. Accepting cookies through the browser's default settings is not consent. A browser that rejects third-party cookies by default and requires an active choice to accept them can give valid consent; a browser that accepts everything until the user switches it off cannot. In practice, every Greek site needs its own consent mechanism.

## Which cookies are exempt?

The HDPA lists the cookies that fall within the exemption: session cookies needed to keep what the user enters, such as a form or a shopping cart; authentication cookies for services that require login; security cookies, such as those that detect repeated failed login attempts; load balancing cookies; and cookies that remember the user's display choices, such as language.

Analytics cookies are not exempt, even when they serve only to measure traffic. The HDPA states that third-party analytics such as Google Analytics may be used only after the user consents. Its guidance adds that the European authorities recognize the lower risk of first-party analytics cookies set by the site itself, and that in that case it is enough to offer the user a way to opt out. Third-party analytics and all advertising cookies need prior consent.

## What must a Greek cookie banner do?

The HDPA's Guidelines 1/2020 set out compliance points for websites. Its press release of 9 May 2022 quotes two of them:

- **C4:** the user must be able, with the same number of actions (clicks) and from the same level, either to accept the trackers that need consent or to reject them, all at once or by category.
- **C7:** to avoid steering users toward acceptance, the buttons should use the same size, highlighting, color and font, with the same readability.

The HDPA's general guidance adds that the information must be visible and specific to each case, explaining the purposes of the cookies used, and that a general mention in the terms of use or a long privacy policy is not enough. Users must be able to withdraw consent the same way they gave it and change their preferences while browsing. A banner that nudges users toward accepting is considered insufficient. The [Reject all guide](/guides/reject-all-button) covers the design.

## Who enforces cookie rules in Greece?

Article 13 of Law 3471/2006 makes the Hellenic Data Protection Authority competent to apply the law, alongside the Hellenic Authority for Communication Security and Privacy (ADAE), which deals with network security and confidentiality. Cookies on websites are an HDPA matter. The HDPA also enforces the GDPR.

On 9 May 2022, the HDPA announced an ex officio audit of 30 news and information websites chosen by traffic. Their banners showed "I agree" and "More options" on the first level, with no reject option, and highlighted the agree button in a color that prompted its selection. The HDPA gave the sites 15 days to comply. All but one did. The HDPA warned that it can impose administrative penalties when sites do not comply.

## How high are the fines in Greece?

For breaches within its jurisdiction, Article 13(4) of Law 3471/2006 lets the HDPA impose the administrative penalties provided by Article 21 of Law 2472/1997, the former data protection act. That act has been largely repealed by Law 4624/2019, which leaves the exact range for a pure cookie breach uncertain, so we do not quote one. When cookies process personal data, the HDPA can also apply the GDPR, with fines up to 20 million euros or 4% of worldwide annual turnover. Article 14 adds civil liability: compensation for non-pecuniary damage caused by a breach of the law is set at no less than 10,000 euros, unless the claimant asks for less.

We found no published HDPA fine for cookies alone as of October 2026. The 2022 action ended in compliance rather than penalties.

## Does the banner have to be in Greek?

We found no rule that sets the language of a cookie banner specifically. The HDPA requires information that is visible, specific and clear, so a site aimed at Greek visitors should present its banner in Greek.

## How Cookiequiet fits

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default with the same size and color, which is what points C4 and C7 describe, and the banner is shown in Greek to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting is included on every plan, [including Free](/pricing). Check your site with the [cookie scanner](/tools/cookie-scanner) first.

## Questions

### Who enforces cookie rules in Greece?

The Hellenic Data Protection Authority (HDPA). Article 13 of Law 3471/2006 makes it competent for the law, including the cookie rule in Article 4(5), and it also enforces the GDPR.

### Does a Greek cookie banner need a Reject button on the first layer?

Yes. The HDPA's Guidelines 1/2020 require that users can accept or reject trackers from the same level and with the same number of clicks, with buttons of the same size, color and readability. In 2022 the HDPA ordered 30 news sites to fix banners that lacked this.

### Do Google Analytics cookies need consent in Greece?

Yes. The HDPA says third-party analytics such as Google Analytics may be used only after consent. Its guidance notes that first-party analytics set by the site itself carry a lower risk and that an opt-out can be enough in that case.

### Can browser settings replace a cookie banner in Greece?

Rarely. Law 3471/2006 mentions browser settings, but the HDPA accepts them only if the browser asks for consent for each cookie. Default settings that accept cookies are not consent.

## Sources

- [Law 3471/2006 as amended by Law 4070/2012 (English text published by the HDPA)](https://www.dpa.gr/sites/default/files/2019-10/law_3471_06en.pdf)
- [HDPA, Η χρήση cookies και συναφών τεχνολογιών στο διαδίκτυο (use of cookies, exempt categories)](https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/electronikesepikoinwnies/cookies/cookies_diadiktuo_cookies)
- [HDPA, Ενημέρωση και συγκατάθεση (information and consent, browser settings, same number of clicks)](https://www.dpa.gr/enimerwtiko/thematikes_enotites/electronikesepikoinwnies/cookies/enimerwsh_kai_sugatathesi_cookies)
- [HDPA, Cookies στατιστικής ανάλυσης (analytics cookies)](https://www.dpa.gr/enimerwtiko/thematikes_enotites/electronikesepikoinwnies/cookies/statistikh_cookies)
- [HDPA, Action of the Hellenic DPA on informational websites' cookies (press release of 9 May 2022)](https://www.dpa.gr/en/enimerwtiko/press-releases/action-hellenic-dpa-informational-websites-cookies)