Croatia cookie consent rules from AZOP and HAKOM

Croatia requires prior, informed consent before a website stores or reads any cookie that is not strictly necessary, under Article 43(4) of the Electronic Communications Act. Two authorities share enforcement: HAKOM, the Croatian Regulatory Authority for Network Industries, supervises the cookie rule itself, and AZOP, the Personal Data Protection Agency, enforces the GDPR for the personal data cookies collect. AZOP has already fined two betting companies for cookies set without a valid legal basis.

Croatia's cookie consent framework

Croatia's cookie rules sit at the intersection of two legal instruments: the EU General Data Protection Regulation (GDPR), which applies directly, and the national Electronic Communications Act (Zakon o elektronickim komunikacijama, Official Gazette No. 76/22, as amended), which transposes the ePrivacy Directive into Croatian law. Both shape how your website must handle cookies when serving visitors from Croatia.

Enforcement is split. HAKOM (Hrvatska regulatorna agencija za mrezne djelatnosti) carries out inspections under the Electronic Communications Act, including the cookie rule in Article 43(4), and breaches of that rule are misdemeanours under Article 166. AZOP (Agencija za zastitu osobnih podataka), the Croatian Personal Data Protection Agency, enforces the GDPR for personal data collected through cookies, and it is AZOP that has fined websites over cookies so far.

If your site targets Croatian users or processes data of individuals in Croatia, these rules apply to you regardless of where your business is based.

What the Electronic Communications Act requires

Article 43(4) of the Croatian Electronic Communications Act transposes Article 5(3) of the ePrivacy Directive and establishes a clear consent-first model. Cookies and similar tracking technologies may only be placed on a user's device after the user has given consent, having received clear and complete information, in particular about the purposes of the processing.

Two narrow exemptions exist:

• Transmission-necessary cookies - cookies strictly required to carry out the transmission of a communication over an electronic network (for example, load-balancing cookies).

• Service-requested cookies - cookies necessary to provide an information society service explicitly requested by the user (for example, PHPSESSID for maintaining a shopping basket, or a cookie that stores the language the visitor chose).

Everything else - analytics cookies like _ga, advertising trackers like _fbp, social media widgets - requires prior consent before activation.

Consent quality under Croatian law

Consent must meet the standard set by Article 7 of the GDPR: freely given, specific, informed, and unambiguous. Pre-ticked checkboxes do not qualify. Continuing to browse the site does not qualify. Cookie walls that block all content unless the user accepts tracking are considered coercive and likely invalid.

Your cookie banner must provide clear information about each cookie category and its purpose, and visitors must be able to accept or reject non-essential categories individually.

Penalties for non-compliance

Under Article 166(1) of the Electronic Communications Act, a company that places or reads cookies without consent faces a misdemeanour fine of HRK 100,000 to HRK 1,000,000. The act still states the amounts in kuna, which convert at the fixed rate to about EUR 13,270 to EUR 132,720. This is separate from GDPR fines, which can reach up to EUR 20 million or 4% of global annual turnover.

AZOP has shown a willingness to impose significant GDPR penalties. On 14 November 2025, it fined a telecommunications operator EUR 4,500,000 for transferring personal data to third countries without a valid instrument and without informing the people concerned, among other breaches. A bank received a EUR 1,500,000 fine for processing personal data of about 434,000 users without a valid legal basis through its mobile application.

Cookie-specific enforcement is also on the record. On 14 September 2023, AZOP fined two gambling and betting companies EUR 20,000 and EUR 30,000. Their websites collected personal data through cookies without a legal basis, offered no separate consent for each type of cookie, and did not tell visitors what each cookie did or how long it was kept.

How Croatian rules compare to neighbouring EU states

Croatia's requirements are broadly consistent with other EU member states, but enforcement intensity and specific local provisions vary. The table below compares Croatia with its neighbours.

Checklist for Croatian cookie consent

Use this checklist to check your site against the Electronic Communications Act and the GDPR.

1. Audit your cookies - Run a cookie scan to identify every cookie and tracker your site sets. Categorise each as strictly necessary, functional, analytics, or advertising.

2. Block non-essential cookies before consent - No analytics or marketing cookies should fire until the visitor has actively opted in. This applies to scripts, pixels, and embedded iframes.

3. Display a clear banner - The banner must clearly state what cookie categories exist, what each does, and allow the user to accept or reject each category. Provide equal visual prominence to accept and reject options.

4. Record and store consent - Keep a log of each visitor's consent choice, including timestamp, categories accepted, and the version of your cookie policy in effect. This is your evidence if AZOP or HAKOM investigates.

5. Make withdrawal easy - Visitors must be able to change or withdraw consent at any time, in no more steps than it took to give it.

6. Publish a cookie policy - List all cookies by name, purpose, provider, duration, and category. Reference the Electronic Communications Act and GDPR as legal bases.

7. Review regularly - New scripts, plugins, or third-party tags may introduce cookies you did not approve. Schedule periodic scans.

Transparency is the 2026 enforcement theme

The European Data Protection Board's coordinated enforcement action for 2026, launched on 19 March 2026, examines how organisations meet the transparency duties in Articles 12 to 14 of the GDPR. Both AZOP decisions above turned partly on transparency: visitors and customers were not told what was done with their data.

For website operators, this means your cookie policy and banner text must be genuinely informative rather than perfunctory. Vague descriptions like "functional purposes" or "improving user experience" without specifics are increasingly likely to attract scrutiny.

Excessive collection is the other recurring theme: the bank's app sent the list of installed applications to the bank, which AZOP found excessive. If your cookie banner collects consent for categories of cookies that your site does not actually use, that discrepancy could itself be flagged as a transparency failing.

Geo-detection and serving the right banner

If your website serves visitors from multiple countries, the consent model shown to Croatian visitors should reflect Croatian and EU requirements. A banner configured for a US audience under the CCPA opt-out model would not satisfy the opt-in requirement under Croatian law.

Geo-detection rules allow you to display the appropriate consent model based on the visitor's location. Croatian visitors should see an opt-in banner with granular category controls. Visitors from jurisdictions with different rules can see a banner calibrated to their local requirements.

This approach avoids over-blocking for visitors from less restrictive jurisdictions while keeping the opt-in model for Croatian visitors. The global compliance hub sets out the rules for other countries.

Google Consent Mode and Croatian visitors

If your site uses Google Analytics, Google Ads, or Google Tag Manager, Google Consent Mode v2 is relevant. Consent Mode allows Google tags to adjust their behaviour based on whether the visitor has granted or denied consent.

For Croatian visitors, Consent Mode should default to denied for analytics_storage and ad_storage until the visitor provides opt-in consent through your cookie banner. Once consent is given, the consent state updates and tags fire normally.

Short answers on Croatian cookie rules

Give Croatian visitors a granular choice

If you are unsure which cookies your site sets or whether your banner offers a choice per category, start with a free scan. Kukie.io detects and categorises your cookies and blocks the non-essential ones until visitors choose.

Start free