GDPR and cookies in 2026: what actually applies to a Greek website

If you run a Greek website with Google Analytics, a Meta pixel (code that tracks visitors for your ads) or embedded videos, then you need consent before any of them loads, and your banner must have a refuse button as easy to use as the accept button. That is not my interpretation, and it is not something I thought up one evening because I was short of a topic. It has been written in an official document of the Hellenic Data Protection Authority since 2020.

Let me tell you the most common mistake I see on Greek sites, and it is not the wording in the footer. It is the belief that cookies are governed by the GDPR. They are not, at least not by the GDPR alone, and that misunderstanding leads to the wrong conclusions. So let us start where the confusion starts.

It is not one law, it is two

Regulation (EU) 2016/679 governs the processing of personal data. Article 4(11) defines consent as a “freely given, specific, informed and unambiguous indication of the data subject’s wishes”, and Article 7 adds that the controller must be able to demonstrate it and that withdrawal must be as easy as giving it. Hold on to that “able to demonstrate”, we will come back to it.

Cookies, however, are governed by a different provision, and this is exactly where most people get lost: Article 5(3) of Directive 2002/58/EC, transposed in Greece by Article 4(5) of law 3471/2006. It states that storing information, or gaining access to information already stored, in the terminal equipment of a user is only allowed after consent, following clear and comprehensive information.

Picture it this way. The visitor’s device is their house. The GDPR deals with what you do with whatever you took out of it. Law 3471/2006 deals with the knock on the door itself, before we even discuss what you took.

That distinction has one important consequence. The rule applies regardless of whether the stored information is personal data. Again, this is not my opinion: the Court of Justice of the European Union confirmed it explicitly in C-673/17 Planet49 on 1 October 2019, where it also ruled that a pre ticked checkbox is not valid consent.

So the argument “I do not collect personal data, therefore I do not need a banner” is legally wrong at its root. I have heard it many times, always delivered with great confidence.

What passes without asking and what does not

The last row deserves attention, because that is where a trap hides, and plenty of people fall into it. The EDPB Cookie Banner Taskforce report (the EDPB is the European Data Protection Board), adopted on 17 January 2023, records as the common position of European authorities that legitimate interest cannot be a legal basis for setting cookies under Article 5(3). And yet many off the shelf banners sold in the Greek market still offer that option in their settings. You have seen it, an innocent looking line in the settings panel that does not hold up.

The eight rules the Authority has already written down

The document anyone running a Greek site should read is called Recommendations 1/2020, issued on 25 February 2020. It uses the term “tracker” and covers not only cookies but also HTML5 local storage (a storage space inside the browser), device fingerprinting (recognising a device by its characteristics), and operating system and hardware identifiers.

The practical rules, as the Authority states them:

1. Pre ticked boxes, continued browsing and scrolling are not consent.

2. Browser default settings that accept cookies are not consent.

3. If the user expresses no choice, no non essential tracker may be used.

4. Acceptance and refusal must be possible with the same number of clicks and from the same layer.

5. Withdrawal must use the same means and be as easy as giving consent.

6. Refusal may not result in exclusion from the content.

7. The buttons must have the same size, the same emphasis and the same colour.

8. The banner must reappear after the same interval, whether the user accepted or refused.

Read them once more, then picture your own banner. How many of the eight does it actually keep?

And one point that surprises most people, which I have kept for last on purpose: Recommendation A.4 names Google Analytics explicitly and states that third party statistical analysis tools may only be used with the user’s consent. There is no “statistics exemption” in the Greek framework today.

How far the rule really reaches

If your reaction was “fine, I drop the cookies and I am done”, let us not rush. In October 2024 the European Data Protection Board issued Guidelines 2/2023 on the technical scope of Article 5(3). The conclusion is that the rule is not about cookies alone.

Explicitly covered: tracking pixels and tracked links, because even temporary storage in the browser cache counts as storage. Local storage. Unique identifiers. IP based tracking where the address originates from the user’s equipment. Even HTTP headers and ETags, the technical details the browser and the server exchange on every page.

In practice that means a page which sets no cookie at all but loads a Meta pixel is squarely within scope. “I do not use cookies” is, sadly, not an answer.

What changes in 2026 and what has not changed yet

There are two developments the Greek market has not yet caught up with.

The ePrivacy Regulation proposal was withdrawn. COM(2017)10, which the market waited on for eight years, appears in the Commission’s list of withdrawn proposals published in the Official Journal on 6 October 2025. It is not coming. Eight years of waiting, and the answer arrived as one line in a list.

The Digital Omnibus took its place. On 19 November 2025 the Commission tabled proposal COM(2025) 837, which moves the cookie rule out of the ePrivacy Directive and into the GDPR itself, as a new Article 88a. The points that matter for a small business:

• A new exemption from consent for audience measurement carried out by the provider of the service, exclusively for its own use. That is first party analytics with no banner, which is not permitted in Greece today.
• Refusal must be possible “through a single click button or an equivalent means”.
• After a refusal, re asking for the same purpose is prohibited for at least six months.
• A new Article 88b: choices are to be expressed through machine readable browser signals which websites must honour.

Mind the wording, and here I want to be completely clear: this is a proposal, it has not been adopted. The EDPB and the European Data Protection Supervisor (EDPS) published a joint opinion in February 2026 supporting the aim of tackling consent fatigue, with reservations on other points. Until it passes, everything described above still applies.

Let us be honest about enforcement in Greece

This calls for honesty, because numbers circulate that do not exist.

In May 2022 the Authority audited 30 news websites on its own initiative and found violations of Recommendations 1/2020, mainly the absence of an equally accessible refusal and visual emphasis on the “I agree” button. After notification all but one complied. No fine was imposed.

The only published fine citing Article 4(5) of law 3471/2006 is decision 50/2017, of 75,000 euro, and it concerned trackers inside marketing emails.

If someone is selling you compliance on the fear of a specific Greek banner fine, ask them for the decision number. Watch what comes back. The real risk is not the fine. It is the complaint, the audit, the time it eats, and the fact that a non compliant setup usually means the rest of your data handling is not in order either.

Eight questions for your site

Open your site in a private window and check:

1. Before you click anything, open your browser’s Developer Tools (F12 key, Network tab) and see whether requests have already gone out to google-analytics.com or facebook.net. If they have, your banner is decorative.
2. Is there a refuse button on the first layer, not behind “Settings”?
3. Do the two buttons have the same size and colour?
4. Does closing the banner with the X activate trackers?
5. Is there a way to change your mind later without hunting for it?
6. Does the cookie policy state the purpose, duration and recipient per tracker, or is it generic text?
7. Do you keep a record of consents, with timestamp and notice version?
8. If someone refuses, does the banner reappear more often than for someone who accepted?

Point seven is the one that fails most often, and that is no accident. Article 7(1) GDPR requires you to demonstrate consent. A banner that looks correct but keeps no record does not cover you on the day you are asked. And that day, if it comes, does not send a warning first.

MS-Consent

The hard part in all of the above is not the banner. It is the proof: Article 7(1) requires you to be able to show that the visitor consented, and most free banners keep nothing. Handsome on the surface, hollow inside.

That is the gap MS-Consent fills, a tool in the MS-Logic ecosystem that is already available. What it does:

• Shows and records consent in line with the GDPR, through a discreet banner at the bottom of the page.
• Keeps trackers frozen until the visitor says yes. Google Analytics, the Facebook pixel and embedded videos do not load before acceptance.
• Each visitor’s choice is stored as anonymous proof: what was accepted and when. No name, no email, no personal details.
• A permanent privacy button at the bottom left, so the visitor can change their mind at any time. That is the requirement of Article 7(3) and of Recommendation C.5.
• Greek and English, switching automatically on English URLs. On mobile and on desktop.
• Two lines of code at the top of the page. It works on any website, WordPress, Wix or custom, not only the ones we host. We handle the configuration centrally.

And now two things I will not tell you, because they would not be true. First, no tool makes you “100% legally covered”. MS-Consent is a strong compliance tool, but final responsibility stays with the site owner, and I am not a legal adviser either. Second, freezing trackers on a site we do not control requires an extra per site setup. On our own sites it is close to automatic, elsewhere we verify it before telling you that you are in the clear.

Why this matters in the end

Cookie compliance is not a legal text in the footer. It is a technical setup: what loads when, what gets recorded, and what you can prove. The rules have been written down since 2020, they are specific, and many Greek sites fail them, often simply because nobody has read them.

If the Digital Omnibus is adopted, it will bring some relief on audience measurement and more strictness on how refusal is handled. Until then, the eight point audit usually does not take long and shows you clearly where you stand.

Which brings us back to the door we started with. A visitor lets you into their house for a few seconds. The least you owe them is to knock first.

If you do not know what your site loads before anyone clicks anything, we check it and, where needed, install MS-Consent: a consent banner, real blocking of trackers before acceptance and a record of every choice. Before telling you that you are in the clear, we confirm on your own installation that the blocking works, without promising full legal cover. Send me through the form your site address and the measurement or advertising tools you use.

The whole picture: this article covers one part of a larger subject. If you are after the whole of it, from beginning to end, it is in the guide to security and legal on your website.