Cookies on Serbian Websites: What the Law Requires, a Cookie Policy Template and a Banner Test (2026)

If your website uses Google Analytics, Meta Pixel, an embedded YouTube video or a Google map, Serbian law requires the visitor’s consent before those cookies are set. Not afterwards, and not “by continuing to use this site”, but before. Without consent, only the cookies the site needs to work may run: the web shop cart, the account login, the language choice.

The rule is not new in 2026. The Electronic Communications Act introduced it in 2023, and most Serbian websites still ignore it. Below you will find the exact wording of the law, a cookie policy template, a cookie table for a typical WordPress site and a two-minute test that shows whether your cookie banner actually blocks anything.

In short: Strictly necessary cookies work without consent. Analytics and marketing cookies only after the visitor clicks “Accept”. Refusing must be as easy as accepting, and consent must be possible to withdraw. A banner that only informs, while Google Analytics loads in the background, does not meet the law.

What website cookies are

Cookies are small text files a website stores in the visitor’s browser. They let the site remember the cart, the login or the chosen language, but also recognise the same visitor on the next visit, measure behaviour and show ads.

Two distinctions worth knowing:

• First-party cookies are set by your own site. Third-party cookies are set by other services through your site: Google, Meta, YouTube, TikTok.
• By purpose: strictly necessary (the site does not work without them), functional (they remember user choices), analytics (traffic measurement) and marketing (tracking for advertising).

The law does not look at the technical type of a cookie, only at its purpose. The same mechanism can be necessary (a cart) or require consent (ad tracking).

What the law actually says

Article 160(4) of the Electronic Communications Act (Official Gazette of the Republic of Serbia, No. 35/2023), in our unofficial translation:

“The use of electronic communications networks and services to store information, or to gain access to information already stored, in the terminal equipment of an end user is permitted on condition that the end user has given consent, after being provided with clear and complete information about the purpose of the collection and processing of the data, in accordance with the law governing personal data protection, and has been offered the opportunity to refuse such processing.”

“Information stored in the terminal equipment” means cookies and similar technologies (local storage, pixels). Paragraph 5 of the same article exempts technical storage that is necessary to carry a communication or to provide a service the user explicitly requested. That is the legal basis for strictly necessary cookies running without consent.

What changed in 2023. The old act (Article 126(3)) required only information and the possibility to refuse, which in practice meant cookies ran until the user switched them off. The new act requires that the user has given consent. The old article was repealed (Article 180 of the new act), so a banner saying “this site uses cookies, by continuing you agree” is no longer enough.

What kind of consent. The act refers to the Personal Data Protection Act (ZZPL), which defines consent as a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action (Article 4). In addition (Article 15):

• you must be able to prove that consent was given;
• withdrawing consent must be as easy as giving it;
• the visitor must know before consenting that they can withdraw.

Cookie identifiers and IP addresses can be personal data (ZZPL Article 4), so the ZZPL also applies to analytics and advertising cookies.

What is unclear. As far as we could verify, the Electronic Communications Act has no specific misdemeanour fine tied to Article 160. In practice the ZZPL and the Commissioner’s powers apply, with fines of RSD 50,000 to 2,000,000 for a legal entity and RSD 20,000 to 500,000 for a sole trader (Article 95). Some professional guides still say Serbia has no special cookie rules, yet they too conclude that non-essential cookies in practice need prior consent.

The two-minute test: does your banner really block cookies

1. Open the site in a private browser window (Ctrl+Shift+N in Chrome).
2. Do not click anything on the banner.
3. Open developer tools (F12), the Application tab, then Cookies and your site’s address.
4. Look for _ga, _ga_ and _fbp. If they exist before you clicked anything, scripts load before consent.
5. Delete the cookies, reload the page and click Reject. If _ga or _fbp still appear, the reject button does not work.

Most Serbian sites fail this test, often because the banner was added as decoration while the analytics scripts were placed directly in the theme or behind a cache the banner never sees.

Cookie table for a typical WordPress site

These are the cookies we see most often on Serbian websites. Check durations in developer tools, because services change them from time to time and browsers shorten them.

An embedded YouTube video or Google map sets cookies as soon as the page loads. The fix is to show an image with a “Load video” or “Show map” button instead, which loads the content only after consent.

Cookie policy template

A cookie policy is a separate document from the privacy policy: the privacy policy describes all data processing, the cookie policy describes each cookie. We explain the privacy policy, with a template, in our privacy policy template for Serbian websites. Replace everything in square brackets and list only the cookies your site really uses.

COOKIE POLICY

Last updated: [date]

1. What cookies are. Cookies are small text files that the website [site address] stores in your browser. We use them to make the site work and, with your consent, to measure traffic and for advertising.

2. Who uses them. The data controller is [company name], [address], tax ID [PIB], email [email].

3. Legal basis. We use strictly necessary cookies without consent, because without them the site cannot provide the service you requested. We set analytics and marketing cookies only with your prior consent, in line with Article 160 of the Electronic Communications Act and the Personal Data Protection Act.

4. Cookies we use. [Table: cookie name, set by, purpose, duration, whether consent is required.]

5. Third-party cookies. Some cookies are set by [Google, Meta, …] when their services load on the site. These services also process data under their own rules, and data may be transferred outside the Republic of Serbia. Details are in our Privacy Policy [link].

6. Managing consent. You can give, change or withdraw consent at any time through the “Cookie settings” link in the site footer. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. You can also delete cookies in your browser settings.

7. Changes. We update this policy when we add or remove a service that uses cookies. The current version is always on this page, with the date of the last update.

You can see a published example on our own cookie policy page.

Seven mistakes we see most often

1. “By continuing to use this site you accept cookies.” That is not consent. Consent is a clear affirmative action, not silence.
2. A banner without a “Reject” button, or with rejection hidden three clicks deep. Refusing must be as easy as accepting.
3. Pre-ticked boxes for analytics and marketing. Consent must be an active choice.
4. Scripts load before consent. The banner looks right, but _ga is already in the browser. This is the most common and most expensive mistake.
5. No way to change the choice later. A “Cookie settings” link should always be available, usually in the footer.
6. Text that mentions only the GDPR. For a site operating in Serbia, the Serbian laws and the Commissioner are what count.
7. A copied policy that lists cookies your site does not use and leaves out the ones it does.

Google Consent Mode: do you need it in Serbia

Google’s user consent policy explicitly covers visitors from the European Economic Area, the UK and Switzerland, and Serbia is not mentioned. You still need Consent Mode if your site gets visitors from the EU or if you run Google Ads with remarketing and conversion tracking.

Consent Mode sends Google four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. In basic mode Google tags do not load until the visitor answers the banner. In advanced mode they load with a default denial and send cookieless data. For a site that targets only Serbia, basic mode is the simplest way to comply with Serbian law as well.

What is coming: the draft new Personal Data Protection Act

From 30 July to 10 September 2026 the Ministry of Justice held a public consultation on a draft new Personal Data Protection Act. This is a draft, not an adopted law, and the text may change. Two points matter for cookies:

• minimum fines would rise: for both legal entities and sole traders they would start at RSD 200,000, instead of today’s 50,000 and 20,000;
• consent could also be given by “conclusive action” (konkludentna radnja), new wording compared with the current act.

Practitioners already warn that cookie banners and website forms will need to be aligned once the law is adopted. We will update this article when that happens.

An example from the Commissioner itself

The website of the Commissioner for Information of Public Importance and Personal Data Protection uses only three necessary cookies, no Google Analytics and no Meta Pixel, and therefore has no classic consent banner. It is a good reminder: the simplest way to comply is not to use cookies you do not need.

When you need a tool, not just a text

A cookie policy is text. Consent is how the site behaves. If scripts load before the click, no text will help. On our clients’ WordPress sites this is handled by the RXN Cookie Consent Kit: it blocks scripts until consent, works with page caching (WP Rocket, Cloudflare) and keeps a cookie list actually verified on the site. If you are not sure what your site sets, checking it is part of our website maintenance.

Note: This article is a practical guide, not legal advice. Quotations come from the Electronic Communications Act (Official Gazette of the RS, No. 35/2023) and the Personal Data Protection Act (Official Gazette of the RS, No. 87/2018); the English wording is our unofficial translation. The legal position was checked on 10 October 2026.

FAQ: cookies on Serbian websites

Does my website need a cookie banner?

If it uses any cookie that is not necessary for the site to work (Google Analytics, Meta Pixel, an embedded YouTube video or Google map), it must ask for consent before setting those cookies, and a banner is the usual way. A site that uses only strictly necessary cookies does not need a banner, but it should still describe its cookies.

Which cookies do not require consent?

Those necessary to provide a service the user explicitly requested: the web shop cart, the account login, form security, the chosen language and remembering the cookie choice itself.

Does Google Analytics require consent in Serbia?

Yes. Analytics cookies are not necessary for the site to work, so under Article 160 of the Electronic Communications Act they may be set only after the visitor gives consent.

Is “by using this site you accept cookies” enough?

No. Since 2023 the law requires consent, and under the Personal Data Protection Act consent must be given by a statement or a clear affirmative action, not by continuing to use the site.

Do I need a separate cookie policy besides the privacy policy?

The law does not prescribe a separate document, but it is the practical solution. The privacy policy describes all data processing, the cookie policy lists each cookie with its name, purpose and duration, and it is easier to update when you add a new tool.

What is the fine for cookies without consent?

Under the Personal Data Protection Act, processing without provable consent carries a fine of RSD 50,000 to 2,000,000 for a legal entity and RSD 20,000 to 500,000 for a sole trader. The draft new act sets higher minimum fines.

Sources: Electronic Communications Act (Official Gazette of the RS, No. 35/2023), Personal Data Protection Act, Paragraf: draft new ZZPL, Google: EU user consent policy, Google: Consent Mode, Commissioner: cookie policy.