Cold Email Laws in Greece: Opt-In Even for Companies

November 2, 2026. Greece is an opt-in country for marketing email with one twist that catches business-to-business senders: the rule applies to companies as well as people. Article 11 of Law 3471/2006 allows unsolicited electronic communications for direct marketing "μόνο αν ο συνδρομητής συγκατατεθεί εκ των προτέρων ρητώς," only if the subscriber has consented in advance and expressly, and paragraph 7 states that "Οι ανωτέρω ρυθμίσεις ισχύουν και για τους συνδρομητές που είναι νομικά πρόσωπα," the rules also apply to subscribers that are legal persons. The only exception is the soft opt-in for existing customers of similar products, with a free and easy objection route in every message. Every marketing email must identify the sender and give a valid address for stopping the messages, and under Presidential Decree 131/2003 the subject line must flag the commercial nature of the content. The civil penalty has a statutory floor: article 14 sets compensation for non-material harm "κατ' ελάχιστο, στο ποσό των δέκα χιλιάδων ευρώ," a minimum of 10,000 euro for a violation, and in decision 401/2025, reported in February 2026, the Piraeus Court of Appeal applied that floor five times over for five unlawful calls, awarding 50,000 euro. Here is the law as the Hellenic Data Protection Authority publishes it, and what a cold email programme has to look like to run in Greece.

The rule: prior express consent, companies included

Paragraph 1 of article 11, as amended in 2011, reads: "Η χρησιμοποίηση αυτόματων συστημάτων κλήσης, ιδίως με χρήση συσκευών τηλεομοιοτυπίας (φαξ) ή ηλεκτρονικού ταχυδρομείου, και γενικότερα η πραγματοποίηση μη ζητηθεισών επικοινωνιών με οποιοδήποτε μέσο ηλεκτρονικής επικοινωνίας, χωρίς ανθρώπινη παρέμβαση, για σκοπούς απευθείας εμπορικής προώθησης προϊόντων ή υπηρεσιών και για κάθε είδους διαφημιστικούς σκοπούς, επιτρέπεται μόνο αν ο συνδρομητής συγκατατεθεί εκ των προτέρων ρητώς." In plain terms: automated calling systems, fax, email and any other unsolicited electronic communication without human intervention, used for direct marketing or any advertising purpose, are allowed only with the subscriber's prior express consent. The HDPA's own guidance page calls this "το λεγόμενο σύστημα «opt-in»" and lists what it covers: email, SMS and MMS, fax, instant messaging, messages on social networks, and calls without human intervention. "Σε διαφορετική περίπτωση το μήνυμα αποτελεί ανεπιθύμητη διαφήμιση (spam)."

Paragraph 7 is the clause that makes Greece different for B2B senders. Because the rules "ισχύουν και για τους συνδρομητές που είναι νομικά πρόσωπα," a cold email to [email protected] or to a named manager at a Greek firm needs the same prior consent as an email to a private individual. There is no corporate-subscriber carve-out; see cold email laws by country for how the rest of Europe splits on this point.

The one exception: existing customers and similar products

Paragraph 3, as rewritten by Law 4070/2012, permits a sender to use email contact details lawfully obtained "στο πλαίσιο της πώλησης προϊόντων ή υπηρεσιών ή άλλης συναλλαγής," in the context of a sale of products or services or other transaction, for direct promotion of the supplier's similar products or services, without prior consent, on one condition: the recipient must be given, "κατά τρόπο σαφή και ευδιάκριτο," clearly and distinctly, the possibility to object "με εύκολο τρόπο και δωρεάν," easily and free of charge, both when the details are collected and in every message. The HDPA summarises the exception as applying when the details "έχουν αποκτηθεί στο πλαίσιο πώλησης παρόμοιων προϊόντων/υπηρεσιών ή άλλης παρόμοιας προηγούμενης συναλλαγής," and notes it extends to mobile numbers and messaging-app accounts obtained the same way. A list bought from a data broker, a scraped address, or a contact met at a trade show is not "a sale or other transaction," so none of them qualifies.

What every marketing email must contain

The subject-line rule is the one most foreign senders have never heard of. A Greek recipient is entitled to know from the inbox list, before opening, that the message is an advertisement. A subject written to look like a personal note, the default style of most cold email sequences, is a separate violation from the missing consent.

Enforcement: the regulator and the 10,000 euro floor

Article 13 gives the Hellenic Data Protection Authority the enforcement powers for the law, and today the fines it imposes for spam are GDPR fines (Law 4624/2019). In October 2018 the HDPA fined Wind, Vodafone, OTE and Cosmote 150,000 euro each for unsolicited calls, "the highest possible pursuant to the legislation before the General Data Protection Regulation," after cross-checking call records against the article 11 opt-out registries that telephone providers must keep for live calls. That case concerned calls, but the authority is the same and the registry mechanism shows how it audits: it pulls the sender's records and matches them against the consent or objection evidence.

The private remedy is where Greece stands apart. Article 14 paragraph 2: "Η κατά το άρθρο 932 Α.Κ. χρηματική ικανοποίηση λόγω ηθικής βλάβης για παράβαση του παρόντος νόμου ορίζεται, κατ' ελάχιστο, στο ποσό των δέκα χιλιάδων ευρώ (10.000 €), εκτός αν ζητηθεί από τον ενάγοντα μικρότερο ποσό." Compensation for non-material damage is set at a minimum of 10,000 euro for a violation of the law, unless the plaintiff asks for less. Paragraph 3 sends these claims to a special civil procedure regardless of any decision of the HDPA, so a recipient does not need a regulatory finding first. Paragraph 6 of article 11 adds a right to demand, under threat of a monetary penalty, that the violator not repeat the breach.

The floor is real in practice. On 17 February 2026 ProtoThema reported that the Single-Member Court of Appeal of Piraeus issued decision 401/2025, "ordering €50,000 in compensation for non-pecuniary damage" for five unlawful promotional calls to an insurance agent who had registered his mobile in the article 11 opt-out register on 22 February 2023 and received repeated electricity-marketing calls between 10 March and 26 June 2023. The claimant sought 10,000 euro per call; the first-instance court found a breach of article 11; the company appealed, and the appeal court ordered 50,000 euro. The calls were made by a contractor for the defendant business. Read across to email, where each message is a communication, a five-email sequence to one unconsenting Greek contact could carry the same arithmetic, though no email ruling was found. Article 15 adds criminal penalties for unlawful use of subscriber data: under paragraph 1, at least one year's imprisonment and a 10,000 to 100,000 euro fine.

What a compliant Greek email programme looks like

1. Consent first, for companies too. Collect express, recorded, revocable consent before the first marketing email to any Greek address, personal or corporate. A web form with a confirmed opt-in, logged with a timestamp, is the kind of mechanism the HDPA's Directive 2/2011 calls for.
2. Use the soft opt-in only for real customers and similar products, with an objection option shown at collection and in every message.
3. Label the subject line. State the commercial character in the subject, name the sender in the body and give a working stop address.
4. Treat Greek contacts in a bought list as unmailable. No lawful basis exists for them under article 11, and each email could ground a claim with a 10,000 euro floor.
5. Prospect by other routes. A live phone call is allowed unless the number is in the provider's article 11 register; inbound content and referrals carry none of this liability; LinkedIn messages may count as social-network messaging, which the HDPA puts under opt-in (see do cold email laws apply to LinkedIn messages).

The deliverability stack matters less in Greece than the consent stack, but it still matters once you have consent: authenticated sending domains and clean lists help a consented programme reach the inbox, and our email infrastructure service sets them up, and email hosting cost compares what the mailbox layer costs by provider. For the opt-in and opt-out split across Europe, see the cold email opt-in versus opt-out map. This is general information, not legal advice.