Most cookie banners we see on Greek e-shops have one of two problems. Either they are decorative, meaning tracking scripts fire before the visitor clicks anything, or they are wired so strictly that Google Ads and Meta go blind and campaigns no longer know what is selling. Both have a cost: the first is legal, the second commercial.
Note: this article is general information, not legal advice. Requirements change. Speak to a lawyer or data protection adviser about your own situation.
The legal framework in one paragraph
GDPR governs how you process personal data, and the ePrivacy rules say that storing or reading information on a user's device (cookies, localStorage, pixels) requires prior consent, unless it is strictly necessary to provide the service. The Hellenic Data Protection Authority has published guidance on cookies that is worth reading, and it has reviewed Greek websites in the past.
What a "proper" cookie banner looks like
Based on guidance from data protection authorities, a compliant banner:
- Loads no non-essential cookies before consent. Analytics, ad pixels and heatmaps wait.
- Makes "Reject" as easy as "Accept". Same level, same prominence. Not a big green "Accept" button next to a small grey "Settings" link.
- Has no pre-ticked boxes for categories.
- Does not treat scrolling or continued browsing as consent.
- Explains in plain language which categories exist and which third parties are involved.
- Lets people withdraw consent easily, for example via a "Cookie settings" link in the footer.
- Logs consent, so you can show what the user chose.
And of course a cookie policy that matches what your site actually uses, not text copied from another shop.
Which cookies are "necessary"
For an e-shop: the cart, the login session, security (such as CSRF protection), possibly storing the cookie choice itself and the language. Google Analytics, the Meta Pixel, the TikTok Pixel, remarketing tags and most heatmap tools are not necessary.
What Consent Mode v2 is
Consent Mode is Google's mechanism that lets its tags (GA4, Google Ads, Floodlight) "listen" to the user's choice and adjust their behaviour. Version 2 added two new signals, and Google requires it for users in the EEA if you want to use features such as remarketing and personalised advertising.
The four core signals:
ad_storage: storing advertising cookies.analytics_storage: storing analytics cookies.ad_user_data: sending user data to Google for advertising.ad_personalization: personalised ads and remarketing.
Basic or Advanced
- Basic: Google tags do not load at all until consent is given. If the user rejects, Google receives nothing.
- Advanced: tags load with a default of "denied" and send cookieless pings. Google uses these to model conversions.
Advanced gives campaigns a fuller picture, but it sends some data before consent. Many advisers in the EU prefer Basic out of caution. Discuss it with yours. It is not a purely technical decision.
Setting it up in practice
- Choose a CMP (Consent Management Platform) that supports Consent Mode v2. Google keeps a list of certified CMPs, and for some uses (such as AdSense) certification is mandatory. WooCommerce and Shopify both have several plugin or app options.
- Inventory every script on the site: analytics, pixels, chat, reviews, embedded video, maps. Many shops carry forgotten pixels from old campaigns.
- Categorise each script: necessary, analytics, marketing, functional.
- Set a default of "denied" for all signals before any tag loads.
- Connect the CMP to Google Tag Manager or gtag, so the user's choice updates the signals.
- Block non-Google scripts too (Meta, TikTok, Clarity and so on) until consent. Consent Mode only covers Google's own tags.
- Test: open the site in a private window, open developer tools and check which cookies and requests fire before and after the choice. Google's Tag Assistant shows the state of each signal.
Common mistakes
- A banner appears, but pixels have already loaded from the theme or a plugin.
- Consent Mode configured in GTM, while the Meta Pixel loads unchecked.
- The "Reject" button hidden on a second layer.
- A banner that covers "Add to cart" on mobile and is hard to dismiss.
- The user's choice is not stored, so the banner reappears on every page.
- GA4 reporting breaks after launch because nobody checked the settings.
What about your numbers?
You will see less data in analytics after a correct banner goes live. That is expected. Acceptance rates depend heavily on the banner's design and wording, so it is worth making it clear and friendly without becoming misleading. For the gaps in measurement, Consent Mode (especially Advanced) and properly configured conversions help.
Checklist
- No non-essential cookies before consent
- "Accept" and "Reject" on the same level
- No pre-selected categories
- A "Cookie settings" link in the footer
- A cookie policy that matches reality
- A CMP with Consent Mode v2 support
- Default "denied" and correct updates of all four signals
- Non-Google pixels blocked too
- A check with developer tools and Tag Assistant after every change
The bottom line
A proper cookie banner is not just a legal box to tick. It is the foundation for trustworthy data and campaigns that work within the rules. If you want an audit of what your site actually loads and how Consent Mode is configured, see our marketing automation service or get in touch.