Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Greece. Sectoral rules (gambling, telecoms, employment) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- Art 8 Child consent age — lowered to 15 for information-society services (GDPR floor is 13, ceiling 16)
- Art 21 Employee data — necessity for employment relationship; restrictions on workplace monitoring
- Art 22 Special-category permissions — public health, social security, employment law
- Art 27 DPO recognition — qualifications, duties, contact-point obligations
- Art 38–39 Administrative fines and criminal penalties — up to 10 years' imprisonment for aggravated offences
- Art 4(5) Storage / read access on terminal equipment requires prior, informed consent — analytics, marketing, and A/B testing never qualify as strictly-necessary
- Art 11 Direct marketing — email/SMS opt-in (double-opt-in standard); soft opt-in for existing customers' similar products with opt-out at every contact
- Art 13 Unsolicited communications — fines and individual right of action
- Art 4 Public-sector digital service principles — transparency, data minimisation, audit trails
- Art 26 Government website obligations — accessibility, retention limits, processing notices
Regulators
Supervisory authorities that interpret and enforce privacy law here.
Coordination body
- 2022-01-31 · Cookies and tracking technologies — HDPA Guideline 1/2020 (recap and reinforcement) — non-essential cookies require prior, granular, informed consent; pre-ticked boxes invalid; equal-prominence reject button required.
- 2023-09-15 · GA4 and international transfers — HDPA aligned with EDPB position — Google Analytics permissible only with explicit consent under Law 3471/2006 Art 4(5); post-DPF transfers acceptable while Google LLC remains certified.
- 2024-06 · Consent Mode v2 — HDPA confirms that cookieless pings still constitute access to terminal equipment under Law 3471/2006 Art 4(5) — consent required regardless of GDPR Art 6 basis.
Notable enforcement
HDPA enforcement style is moderate but consistent — fines are smaller than the German or French peaks but cover a steady stream of cookie-banner failures, telecom security breaches, direct-marketing violations, and gambling-sector targeting issues. OPAP (national gambling monopoly), Cosmote/OTE (incumbent telco), and Eurolife/Eurobank (financial services) anchor the enforcement narrative. The HDPA tends to publish detailed decisions in Greek with English summaries, and frequently signals expectations through guidelines before issuing fines.
-
Clearview AI HDPA · Art 5, 6, 9, 12, 14, 15, 16 stood
Coordinated EU action — facial-recognition scraping. Greece's HDPA contribution to the cross-DPA enforcement wave (FR, IT, EL, UK).
-
Cosmote / OTE HDPA · Art 5, 32 stood
Security failure leading to exposure of customer data following a 2020 incident. €3.25M to Cosmote + €2.6M to OTE for parent-company oversight failures.
-
OPAP HDPA · Art 5, 6, 7 stood
Telephone marketing without valid consent + insufficient opt-out handling. Largest gambling-sector fine in Greece; HDPA decision 35/2022.
-
Eurolife / Eurobank HDPA · Art 6, 7, 21 stood
Direct-marketing consent failures + insufficient honoring of objection requests across the Eurobank insurance group.
-
Greek Ministry of Migration HDPA · Art 5, 25, 35 stood
Centaur/Hyperion border-surveillance systems deployed without DPIA. Public-sector fine; cited in Council of Europe reports.
-
Skroutz S.A. HDPA · Art 12, 15 stood
DSAR handling failures — incomplete responses to access requests on Greece's largest e-commerce comparison platform.
GA4 status
GA4 is usable in Greece only with prior, explicit, granular consent under Law 3471/2006 Art 4(5). After EU-US DPF (Jul 2023), transfers to Google's US servers are lawful in principle while Google LLC remains DPF-certified. HDPA aligned with EDPB position — moderate enforcement, no aggressive standalone fines on GA4, but consent-banner non-compliance is the primary risk vector.
| DPA | Stance |
|---|---|
| HDPA | Aligned with EDPB — opt-in for non-essential analytics is non-negotiable; post-DPF US transfers acceptable; controllers expected to maintain DPF-status verification + fallback TIA for non-DPF vendors. |
Cross-border transfers + Schrems II
HDPA accepts adequacy for DPF-certified US importers post-10 July 2023. Position is moderate — no aggressive Schrems II enforcement comparable to LfDI BW or CNIL pre-DPF, but HDPA expects controllers to verify DPF certification status before each transfer and to maintain a Transfer Impact Assessment for non-DPF recipients. Greek-language documentation of TIA + supplementary measures expected for any US transfer outside DPF.
EU 2021/914 SCCs remain the fallback when DPF certification is absent or revoked. HDPA reviews SCC implementation in audit cycles but does not publish standalone TIA templates — controllers reuse EDPB Recommendations 01/2020.
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 4 · 0 green · 3 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics legal in Greece in 2026?
How is the HDPA structured and how does enforcement work?
Do I need a Greek DPO?
What is the child digital-consent age in Greece?
What language must my privacy notice and cookie banner be in?
Is 'legitimate interest' a valid basis for analytics in Greece?
Do I need a Greek Article 27 representative?
What's the OPAP fine and why does it matter?
What changed after the Cosmote/OTE €5.85M fine?
Does Schrems II still affect transfers post-DPF?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Greece's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.