Cookie Banners and GDPR: What Cyprus Websites Must Do

Almost every Cyprus website has a cookie banner. Far fewer have one that actually does its job. The usual setup is a small bar at the bottom of the screen with a single "OK" button, sitting on top of a site that already loaded Google Analytics, the Meta pixel and three other trackers before the visitor had a chance to say anything at all.

That arrangement is decorative, not compliant. And because Cyprus is an EU member state, the rules that apply here are the same ones that produced the headline fines you read about in Ireland and France. This article is a plain-English explanation of what is required and how to fix the common mistakes — not legal advice, but enough to have a sensible conversation with your developer or your lawyer.

The rule, in one paragraph

Two pieces of law overlap. The ePrivacy rules say you need permission before storing or reading anything on someone's device — cookies, but also local storage and tracking pixels. The GDPR says that when you rely on consent, that consent has to be freely given, specific, informed and unambiguous. Put them together and you get the practical standard: non-essential tracking must not run until the visitor actively agrees to it. In Cyprus, this is overseen by the Office of the Commissioner for Personal Data Protection.

The important word is "non-essential". Cookies that keep a shopping basket working, remember a login, or protect a form from spam are strictly necessary and do not need consent. Analytics, advertising, remarketing, heatmaps and embedded social feeds are not necessary — they are there for your benefit, not the visitor's.

Five mistakes we see on Cyprus sites every week

• Trackers fire before consent. The banner appears, but the analytics script has already run. This is the single most common failure, and it makes the banner pointless.
• There is no way to say no. If the banner offers "Accept" and a link to a policy, there is no real choice. Reject must be as easy as accept — ideally an equally prominent button on the same screen.
• Pre-ticked boxes. Categories switched on by default are not consent. The visitor has to opt in, not fail to opt out.
• Consent cannot be withdrawn. Once someone clicks accept, the banner disappears forever with no way to change their mind. You need a permanent link — usually in the footer — that reopens the settings.
• No record of what was agreed. If a complaint is ever made, you are expected to be able to show that consent was given, for what, and when.

What a properly working setup looks like

The mechanics are not complicated once someone decides to do them properly.

1. Find out what your site actually loads

Open your site in a private browser window and check the storage panel in your browser's developer tools, or run it through a free cookie scanner. Most owners are surprised — an old chat widget, a YouTube embed and a plugin nobody remembers installing are usually in there.

2. Sort them into categories

Necessary, analytics, marketing, and preferences is the standard split. Each category gets its own toggle so visitors can accept some and refuse others.

3. Block by default

This is the part that separates real compliance from theatre. Scripts in the non-essential categories should not be in the page at all until consent is recorded. In practice this means loading them through a consent management platform or through Google Tag Manager with consent mode configured, rather than pasting them directly into your site template.

4. Give equal choices

"Accept all" and "Reject all" side by side, plus a "Manage preferences" option. No dark patterns, no greyed-out reject button, and no cookie wall that blocks the content until someone agrees.

5. Write a privacy and cookie policy people can read

List what you collect, why, how long you keep it, who else sees it, and how someone can request their data or ask you to delete it. A short honest page beats four pages of copied boilerplate that describes services you do not use.

"Will this destroy my analytics?"

It will reduce your recorded traffic, and it is better to know that now. Depending on your audience, somewhere between a fifth and half of visitors decline tracking, so your reported sessions drop even though your real traffic has not changed.

The fix is not to break the law — it is to stop relying on one number. Server-side statistics, phone calls, form submissions, quote requests and actual revenue are all unaffected by cookie choices, and they were always the numbers that mattered. Treat the analytics drop as a one-off recalibration, note the date, and compare like with like afterwards.

The 30-minute check

Load your homepage in a fresh private window, open developer tools, and look at what has already been set before you touch the banner. If you see anything from an advertising or analytics domain, your banner is not doing anything. Then click "reject" and reload — if the trackers appear anyway, the same is true. That five-minute test tells you more than any compliance badge.

Getting this right is not just about avoiding a fine. A site that asks honestly and clearly, then respects the answer, is the same site that people trust with a credit card. The businesses that treat privacy as a design problem rather than a legal nuisance tend to end up with both.