Cookies and Cookie Banners - Does Serbian Law Require One?

When a small business in Novi Sad launches a website, the cookie banner often feels like an awkward formality - a popup that clutters the page the moment a visitor lands. The question is reasonable: do I really need one, or can I skip it? The short answer is - for most business websites in Serbia, yes, you need one, and under Serbia's own Personal Data Protection Act (ZZPL), not just under the European GDPR. As a Novi Sad-based agency building websites daily for clients across Vojvodina, Belgrade, and the region, we work through this topic on every single project. In this guide, we break down what cookies actually are, when a banner and cookie policy are legally required, what a compliant banner looks like, the mistakes we see on every second Serbian website, and what the actual fines are if a site ignores the rules.

The short answer - do you need a cookie banner

So you don't have to read the whole article for a yes/no question, here it is up front:

• If the site uses Google Analytics, Meta Pixel, Hotjar, or any similar analytics or marketing tool - a cookie banner is required
• If the site uses a YouTube embed, Google Maps embed, Facebook plugin, or similar third-party content - a banner is required, because the embed sets cookies itself
• If the site runs remarketing or conversion cookies (Google Ads, Meta Ads, TikTok Ads, LinkedIn Insight) - a banner is required
• If the site uses only strictly necessary cookies (session, cart, login) - a banner is technically not required, but a cookie policy still is
• If the site also reaches visitors in the EU - GDPR applies on top, and it's stricter than the Serbian baseline
• The only sites fully exempt are static digital business cards - no analytics, no embeds, no third-party content

In practice, that means 95% of business websites in Serbia need a working cookie banner - not just a notice that the site uses cookies, but a functional mechanism to accept or reject them before anything is set.

What cookies are and which categories exist

Before debating banner obligations, it helps to know what we're actually talking about. A cookie is a small text file a website stores in a visitor's browser - usually to remember a session, language choice, cart contents, or user behavior. The visitor often never notices anything happened, but every cookie is potential data collection.

The law doesn't treat all cookies equally. In practice, they split into four categories:

• Strictly necessary - make the site basically work (login session, cart, language memory). No consent needed.
• Functional - remember a visitor's choices (theme, font, location), not for tracking. Consent is usually required.
• Analytics - measure visitor behavior (Google Analytics, Hotjar, Matomo). Consent is required - even for anonymized analytics.
• Marketing - track visitors across multiple sites (Meta Pixel, Google Ads, TikTok Pixel, LinkedIn Insight). The strictest standard - consent must be explicit, informed, and revocable.

When people talk about banner obligations, they mean everything except strictly necessary cookies. If the site has even one cookie outside that category, it cannot set it without consent.

What Serbian law says about cookies

Cookies in Serbia are primarily regulated by the Personal Data Protection Act (ZZPL), which came into force on August 21, 2019. ZZPL is largely aligned with the European GDPR, so the standard required for cookie consent is not more lenient - in most cases it's identical.

The key definition connecting cookies and the law: IP addresses, device identifiers, cookie IDs, and similar technical data are considered personal data under ZZPL. The moment a site sets a cookie that can identify or track a visitor - which every analytics or marketing cookie does - the site becomes a data controller under the law and must follow the rules on consent, information, and user rights.

ZZPL requires that any consent to process personal data must be freely given, specific, informed, and unambiguous. For a cookie banner, that practically means:

• The visitor must know exactly what they're agreeing to - which cookies, which third parties, which purpose
• Consent must be an active action - clicking a button, not implicit acceptance or continued browsing
• Rejecting must be as easy as accepting - not hidden two clicks deep in 'settings'
• Consent must be revocable - the visitor can withdraw it at any time, as easily as they gave it
• The site must keep a record of when and what the user agreed to - in case of a complaint or audit

The competent authority in Serbia is the Commissioner for Information of Public Importance and Personal Data Protection, who can open proceedings based on a citizen's complaint or on its own initiative - and can impose fines on legal entities, sole traders, and responsible individuals.

When GDPR applies on top for a Serbian website

GDPR applies to any company processing data of visitors in the European Union - regardless of where the company is legally registered. For Serbian websites, that means GDPR applies alongside ZZPL in the following cases:

• The site has an English version targeting clients in Germany, Austria, Italy, or any EU country
• An online shop delivers goods to the EU or accepts payments from EU countries
• A SaaS or software company in Novi Sad has users in the EU
• A consultancy or marketing agency works with EU-based clients
• A Serbian-language site targets the EU diaspora and advertises through Google Ads or Meta Ads

GDPR is slightly stricter than ZZPL in the cookie space - it specifically requires detailed cookie categorization, category-specific consent, and the option for a visitor to reject not just marketing but also analytics. If the site falls under GDPR, the banner must have at least three options - accept all, reject all (or necessary only), and detailed per-category settings.

What a compliant cookie banner looks like

A compliant banner is not a matter of design, but of function. To satisfy ZZPL and GDPR, it must meet clearly defined criteria - each tested across hundreds of European rulings and data protection authority recommendations.

The minimum a banner must include:

• A clear question - the visitor must immediately understand what consent is being asked for and why
• An 'Accept all' button - visible and functional
• A 'Reject all' or 'Necessary only' button - the same rank, size, and color as the accept button
• A 'Settings' button - where the visitor picks by category (analytics, marketing, functionality)
• A link to the cookie policy - showing a detailed list of every cookie on the site
• A mechanism to withdraw consent - a small icon or footer link that opens the banner again, without the visitor having to clear cookies from the browser

Before the visitor clicks anything - the site cannot set a single analytics or marketing cookie. This is a common failure on Serbian websites: the banner shows up, but Google Analytics is already running in the background. Such a banner has no legal weight, and technically it's worse than not having one at all - because it confirms the site knows about the obligation and knowingly ignores it.

An extra recommendation that doesn't belong to the strict minimum but is good practice: store the version of the banner the visitor saw and their choice, with a timestamp. If a complaint comes in later, that's your evidence that consent was given correctly.

The most common banner mistakes in Serbia

Unfortunately, most banners we see on Serbian websites don't meet the requirements. Here are six mistakes that appear on nearly every second site and that don't hold up legally:

• The banner just notifies - 'This site uses cookies' with a single 'OK' button. No choice, no consent. Legally useless.
• The 'Reject' button is hidden in 'Settings' or buried two clicks deep - the law requires rejection to be as easy as acceptance
• Cookies are set before the visitor clicks anything - Google Analytics runs while the banner is still visible
• Pre-checked consent - marketing and analytics boxes already ticked, visitor has to uncheck them manually. Consent that isn't active isn't consent.
• No way to withdraw - once clicked, the visitor can't change their mind without clearing cookies in the browser
• No link to a cookie policy - or the link goes to a generic privacy policy with no cookie list by name, purpose, and duration

Each of these is grounds for a complaint to the Commissioner. In practice, fines are usually issued after a specific complaint by a citizen or competitor, not through random audits - but that doesn't mean the risk doesn't exist.

Fines for sites without proper consent

Fines under ZZPL for legal entities range from 50,000 to 2,000,000 dinars per individual violation. For sole traders they're lower, up to 500,000 dinars, and for the responsible person inside a company, up to 150,000 dinars. The violation is tied to each case of improper processing - not to each flawed banner, but to each situation where a citizen reported processing without consent.

For sites subject to GDPR as well, maximum fines are far higher - up to 20 million euros or 4% of global annual revenue, whichever is greater. Small Serbian companies rarely face the maximum amounts, but one serious complaint from the EU is enough to drag a proceeding on for months and cost thousands of euros in legal fees.

Beyond direct fines, there's a practical penalty that hits immediately: Google Ads and Meta Ads suspend accounts of sites without proper cookie consent. The suspension arrives without warning and the only way to recover is full compliance - which means rebuilding the banner, cookie policy, and often the privacy policy as well.

Technical implementation - what the site must actually do

Beyond the visual banner component, there are technical requirements no banner can skip:

• Blocking analytics and marketing before consent - Google Analytics, Meta Pixel, Hotjar, and similar scripts must not load until the visitor clicks
• Granular toggles - every category (analytics, marketing, functionality) must be independently switchable
• Choice persistence - the visitor must not see the same banner on every page; the choice is remembered until they change it
• Consent validity window - recommended maximum of 12 months, after which the visitor is asked again
• Local choice storage - usually in localStorage or a dedicated technical cookie that is not a tracker
• Country-based fallback - if the site detects an EU visitor, it must show the stricter GDPR banner, not the short Serbian version

In practice, most sites solve this with off-the-shelf tools - Cookiebot, Osano, CookieYes, Termly, and similar providers offer integrations that cover most of the technical requirements. For WordPress sites there are free plugins (CookieYes free, Complianz) that work for simpler cases. For custom Next.js and React sites we prefer solutions that don't load an external script for performance reasons - the banner is built as part of the site itself with Google Consent Mode v2 integration, which has been the practical standard since 2024 and without which Google Ads campaigns lose part of their conversion reporting.

For businesses in Novi Sad - local specifics

For companies registered in Novi Sad, Belgrade, or any other city in Serbia, ZZPL applies without exception - regardless of where the hosting is, who built the site, or whether the site is in Serbian or English. Practical advice we give clients:

• The banner must be available in the language of the site - an English version of the site needs an English banner, a Serbian version needs a Serbian one
• The cookie policy must list the full company name, tax ID (PIB), and registration number from APR (the Serbian Business Registers Agency)
• If the site also targets EU clients, the banner is automatically bumped to GDPR level - there's no middle ground
• Google Consent Mode v2 has been the practical standard since 2024 - without it, Google Ads campaigns lose part of their conversion reporting
• For local businesses using only a contact form and a Google Maps embed, the obligation still applies - because the embed loads third-party Google cookies

A cookie banner almost never stands alone - it almost always goes with a cookie policy and a privacy policy. We wrote in more depth about the policy itself in the guide to website privacy policies, explaining what the policy must contain and when hiring a lawyer is justified. A broader list of pages a business website needs - including the cookie policy and terms of service - is covered in the guide to essential website pages.

For the websites we build, the cookie banner, cookie policy, and Google Consent Mode v2 integration are a standard part of a custom-built site - together with the privacy policy and technical blocking of analytics until the visitor consents. The exact scope and what's included in each package is on our pricing page.

Conclusion

A cookie banner doesn't deserve panic, but it can't be forgotten either. For most business websites in Serbia - the moment you have Google Analytics, remarketing, or a single embed - a banner is required, and under Serbian ZZPL, not just when GDPR kicks in. The core rules are simple: ask before setting cookies, give an equal chance to reject as to accept, remember the choice, and document the consent. Everything else is implementation detail - and the difference between a banner that protects you from a complaint and a banner that's just cosmetics.

If you're not sure whether your site respects Serbian law, or you're building a new one and want to be certain it won't trigger a complaint, get in touch - we'll check what the site actually sets in the browser, whether the banner meets the legal requirements, and recommend concrete changes to bring everything in line with ZZPL and GDPR where applicable.