Skip to main content
In Greece, an AI agent may only make marketing calls to people and businesses who expressly agreed to them beforehand. Article 11(1) of Law 3471/2006 requires prior, express consent for marketing communications without human intervention, and the rule protects companies too. Marketing calls by a human are opt-out instead: you must skip every number on the Article 11 registry that each phone provider keeps. The Hellenic Data Protection Authority (HDPA, ΑΠΔΠΧ) enforces both rules.
This page summarizes the law as of October 2026 to help you plan AI phone calls. It isn’t legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.

​
At a glance

Only with prior, express consent. Article 11(1) of Law 3471/2006 covers «μη ζητηθεισών επικοινωνιών με οποιοδήποτε μέσο ηλεκτρονικής επικοινωνίας, χωρίς ανθρώπινη παρέμβαση» for direct marketing. It permits them «μόνο αν ο συνδρομητής συγκατατεθεί εκ των προτέρων ρητώς». In English: unsolicited communications by any electronic means, without human intervention, need the subscriber’s prior, express consent. The HDPA quoted this wording in Decision 7/2026 of June 2026. Until September 2011, the rule also required consent for calls by a human. Law 3917/2011 limited opt-in to automated calls. No B2B exception. Article 11(7) extends the rules to subscribers that are legal persons. Sole traders are natural persons, so the rule covers them anyway. AI agents most likely count. The test is whether a human takes part, not whether a recording plays. The HDPA’s examples of communication without human intervention include calls with a pre-recorded message and voice messages left on answering machines (2019 guidelines). No Greek authority or court has ruled on conversational AI agents. An AI agent that runs the call alone fits the wording, so treat it as automated. A human who only listens in or could take over probably doesn’t turn it into a call “with human intervention” under Article 11(2). Only a call that a human leads is clearly opt-out. The registry doesn’t replace consent. The HDPA says automated calls need consent even when the number isn’t on any registry (HDPA FAQ). In Decision 56/2021, it fined a company EUR 30,000 for automated marketing calls because the company couldn’t prove consent for any complaint (Lawspot).

​
Cold calls by a human

Calls by a human are opt-out for consumers and businesses. Under Article 11(2), you may not call a subscriber who told their phone provider they don’t want marketing calls. The HDPA FAQ adds these duties: If a call center calls for you, you’re the controller. The HDPA expects Article 11 clauses in your contract and regular audits of the call center, and it fines both sides (Decision 7/2026).

​
Existing customers and callback requests

No soft opt-in for calls. The existing-customer exception in Article 11(3) covers email only. The HDPA applies the registries to your own customers as well. A human may still call a registered customer who expressly asked you for calls. AI marketing calls to customers need the same express consent as calls to strangers. Callbacks. Article 11 covers only unsolicited (“μη ζητηθείσες”) communications, so a call the person asked for falls outside it. Keep proof. In Decision 7/2026, the HDPA rejected PPC’s claim that a call followed the complainant’s request, because the call list and the recording didn’t back it up. Stay within the topic they asked about. A landing page where people leave their number and agree to a call from your AI agent works, if the form says an AI agent will call.

​
Do-not-call register: Article 11 registry (Μητρώο 11)

For AI calls, still screen the registries. A registration made after the consent date suggests the person changed their mind. botBrains doesn’t screen lists for you. Reform is under discussion. In November 2025, the energy suppliers’ association ESPEN asked the government for a single registry run by an independent body, with online sign-up (ESPEN letter). We found no bill as of October 2026. Greek law sets no expiry date for consent and no retention period for consent records. Keep the evidence while you rely on it and long enough to answer complaints and lawsuits. Purchased lists. The EDPB says a consent form must name every company that relies on it (Guidelines 05/2020, para. 65). A generic “partners” opt-in doesn’t cover AI calls from you. Ask any data vendor for the exact consent text, the collection method, and evidence per contact. Calls for a partner. The company whose products you promote sets the purpose, so the HDPA treats it as the controller and the calling company as its processor. The HDPA can fine both (Decision 7/2026). Before you start, read what botBrains needs for outbound campaigns.

​
Tell callers they’re talking to an AI

Since August 2, 2026, Article 50 of the EU AI Act requires that people know they’re talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can’t count on the exception for obvious cases when your AI agent sounds human. The default introduction already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the Consumer Rights Directive also requires you to name your company, anyone you call for, and the commercial purpose at the start. Greek law adds rules for the opening of the call: A recommended introduction in Greek for outbound marketing calls:
For inbound calls:
When someone says they don’t want more calls, add them to your objection list. Use guidance to tell the agent how to handle objections, and a Unitool to write the objection to your CRM.

​
Call recording

Article 4(3) of Law 3471/2006 allows recording calls in lawful business practice as evidence of a commercial transaction or other business communication. The text mentions consent from both parties after prior information. The HDPA reads it, in line with the ePrivacy Directive, as requiring prior information only, and a recorded notice before the conversation is enough (HDPA recording FAQ). The exception is narrow (HDPA guidance): Also publish the GDPR Art. 13 details (purpose, retention, recipients) on your website, and give people their recordings on request. The botBrains introduction tells the caller about the recording, and the star key stops the recording and discards it. The transcript stays. In your introduction, name a concrete evidence purpose instead of quality. No Greek source says whether a transcript counts as a recording, so limit it to the same purpose. Recording a voice isn’t biometric processing unless you use it to identify the person (GDPR Art. 4(14) and Art. 9).

​
Caller ID and calling hours

The HDPA says you may not hide or falsify the calling number (HDPA FAQ). The caller sees your botBrains phone number, and botBrains provides Greek numbers on request. We found no Greek rule on calling hours, call frequency, or a special prefix for marketing calls. botBrains doesn’t enforce calling hours, so pick reasonable times yourself. On voicemail, the agent hangs up without leaving a message. That matters, because the HDPA counts voice messages left on answering machines as communication without human intervention.

​
Sector rules

​
Fines and enforcement

The HDPA enforces Law 3471/2006 and the GDPR. In Decision 7/2026, it fined Article 11 breaches under its GDPR powers (Art. 58 and 83). These reach EUR 20 million or 4% of worldwide turnover. People can also sue. Article 14(2) of Law 3471/2006 sets damages for non-material harm at a minimum of EUR 10,000 per breach, unless the plaintiff asks for less. The civil minimum is the bigger risk for campaigns, because courts have counted each call as a separate breach. We found no published Greek decision about AI voice agents.

​
Sources

​
Next steps

Phone integration

Set up your phone line, introductions, and outbound calls.

Calling laws by country

Compare consent rules for AI calls across the EU, the UK, and the US.