Primary Law

The Consumer Protection Law 2021 (“CP Law 2021”) outlines the rights of consumers in Cyprus. It states the framework for unlawful commercial practices, as well as misleading and comparative advertisements. This legislation harmonises the Cypriot national legislation with the corresponding EU legislation which is the primary source of advertising legislation.

Industry-Specific Legislation/Self-Regulation

In addition to the above, there is specific legislation which sets out provisions that are aimed at a certain product or means of communication. It should be noted that part of this specific legislation was enacted to implement EU law. There are various pieces of specific legislation, but indicatively, such provisions are included in the following legislation.

• Specific industry requirements for claims in relation to cosmetics are set out in the Law on Cosmetic Products (106(I)/2001).
• The advertisement of medicinal products is regulated by the Medicinal Products for Human Use Law 70(I)/2001.
• Food Law (Control and Sale) Law 54(I)/1996).
• The Real Estate Agents Law 71(I)/2007 regulates who can advertise real estate property.
• Protection of Health (Control of Smoking) Law 24(I)/2007, prohibits the advertisement of tobacco products.
• Secondary legislation, namely Order 449/2004 which implements Directive 2002/46/EC, provides that no person is allowed, without the prior permission of the Director of the Public Health Service of the Ministry of Health, to publish any advertisement that is intended to promote food supplements in the consumer market.
• Secondary legislation 02/2021, issued by the National Betting Authority and providing the Code of Practice in relation to the advertising of betting. The Broadcasting Code of the Radiotelevision and Digital Services Authority (RDSA) (refer to 1.2 Enforcement and Regulatory Authorities), also secondary legislation, contains specific provisions as to products and services that should not be advertised on radio or television, as well as products and services for which advertisement is allowed under conditions (eg, alcohol).

Self-Regulation

Additionally, there is an Advertising Ethics Code (“CARO’s Code”), published by the Cyprus Advertising Regulation Organisation (CARO), Cyprus’ principal self-regulatory organisation, which, inter alia, includes guidance notes on the topics of alcohol, food, influencer marketing and advertising addressed to children.

There are various regulatory authorities which oversee advertising practices depending on the industry sector in which the trader is engaged. However, the main authorities are the following.

Consumer Protection Service

The primary authority tasked with overseeing unfair commercial practices, including but not limited to misleading advertising, is the Consumer Protection Service (CPS), a department within the Ministry of Energy, Commerce, and Industry. The CPS is responsible for ensuring adherence to the CP Law 2021, probing into business practices when prompted by a complaint or at its own discretion, and initiating legal actions against businesses. In cases where the CPS identifies violations of the applicable laws, it has the authority to take the following measures.

• Order traders and third parties such as domain owners, internet service providers, and in general anyone hosting or reproducing the infringing content in any medium to remove content, restrict access to it, or place a written notice to consumers before accessing the content.
• Apply for injunctive relief against infringing traders.
• Impose administrative fines up to 5% of the annual turnover of the advertiser during the preceding year or up to EUR500,000.

Radiotelevision and Digital Services Authority

The Radiotelevision and Digital Services Authority, or RDSA, serves as the governing body responsible, inter alia, for overseeing the functioning of radio and television stations within the Republic of Cyprus and for assessing the appropriateness of the measures (procedural and technical) to be taken by video-sharing platforms under the jurisdiction of Cyprus. The RDSA maintains its own set of rules known as the Broadcasting Code, and subsequent to an inquiry prompted by a complaint, it possesses the capability to implement the following measures.

• Impose administrative fines of up to EUR8,500.
• Revoke a TV or radio station’s licence either temporarily or permanently.
• Apply to court for injunctive relief.

According to established principles of Cypriot company law, companies have a separate legal personality from their owners/shareholders, and as a result, if the company has used misleading advertising, liability does not extend to these individuals.

However, the CP Law 2021 establishes that a trader for the purposes of the legislation includes not only the natural/legal entity engaged in the trading practice but also anyone acting on behalf of the trader. Consequently, consumers may file an action against directors or other officers of the legal entity which is responsible for deceptive advertising, seeking the remedies identified below.

Criminal Offences

According to Article 64 of the CP Law 2021, any person who takes any action that may hinder or delay the work of the CPS whilst investigating any complaint – ie, by providing false or inaccurate information – commits a criminal offence which is punishable with up to six months imprisonment or a fine of up to EUR100,000 or both of these penalties, and this extends to the directors of a legal person as well.

Third Parties

Where third parties are involved, such as domain owners, internet service providers, and in general anyone hosting or reproducing the advertisement in any medium, the failure to comply with the instructions of the CPS will have the effect that the third party and its directors will have committed a criminal offence.

In the CP Law of 2021, the term “advertising” is defined broadly as any announcement made in the course of a commercial, industrial, craft, or professional activity with the aim of promoting the supply of goods or services, including the transfer or other disposal of property, rights, or obligations.

CARO’s Code provides a brief description of the kind of communications that are considered to be advertising. Examples include advertisements on television and radio stations, on the internet, in newspapers and magazines, in all kinds of external advertising media such as posters, signs, and electronic displays, brochures, catalogues, postal letters with advertising messages and presentations, advertising messages and promotional material sent by fax, e-mail, or through any other electronic and/or printed information medium, advertising messages in product packaging, labels, and point-of-sale materials, and cinema advertisements.

Although there is no mandatory pre-approval process before an advertisement can run, CARO provides the possibility for copy advice. This procedure is an advisory service provided with absolute confidentiality, before the publication/broadcast of an advertisement, and concerns the evaluation of advertising material, in order to identify possible violations of CARO’s Code and its annexes. It should be noted that any advice given in this context is not binding on the person seeking the advice, nor is it binding on CARO in case there is any future complaint in relation to that advertisement.

The CP Law of 2021 contains provisions as to the use of a competitor’s marks or trade marks in the context of comparative advertising. With regards to publicity rights, there are no special rules to govern their use in the context of advertising; however, the GDPR and privacy law, and especially Article 8 of the European Convention on Human Rights (right to privacy) could provide a general framework regarding the use of image rights in advertising, particularly without the individual’s consent. In addition, considerations are set out in CARO’s Code specifying that all marketing communications should not contain any statement or claim which, directly or by implication, omission, ambiguity, or exaggeration, may mislead the consumer, regarding intellectual property rights such as patents, trade marks, designs, and trade names.

CARO is the principal self-regulatory non-profit organisation in Cyprus for all mediums and for all industry sectors. It is a member of the European Advertising Standards Alliance and it has published its own advertising ethics code which is analogous to the code of the International Chamber of Commerce. A substantial number of Cypriot TV stations, radio stations, newspapers, and advertising agencies are members of CARO and are committed to adhere to its Code.

Procedure and Remedies

Any consumer can file a complaint with CARO with respect to an advertisement which the consumer considers to be misleading or contrary to CARO’s Code. CARO operates a fast-track procedure in which the views of both parties (the complainant and the advertiser) are considered before a decision is reached within two weeks. CARO has established a two-tier system for examining complaints and both are able to provide the following remedies.

• Request a withdrawal of the offensive advertisement.
• Order an amendment of the advertisement to render it compliant with its Code.

Whilst CARO is not afforded with the authority to enforce its decisions or to order monetary relief against the advertiser, it is able to enforce its decisions indirectly by taking the following actions.

• Publish its decision on its website.
• Inform media providers, in which the advertisement is exhibited, of CARO’s decision and request the immediate removal of the advertisement (the majority of media mediums have contractually agreed to comply with CARO’s decisions).
• Inform other agencies with extensive regulatory powers such as the CPS, the RDSA, and the Press and Information Office of the Republic of Cyprus to take action against the advertiser.

The CP Law 2021 introduced a private cause of action for any consumer whose economic interests have been negatively affected through any breach of the legislation. As a result, a consumer has the option to take action against any trader who has engaged in deceptive or misleading advertising practices.

The court is able to provide the following remedies to consumers.

• Declare that the contract is illegal, thereby the consumer is no longer legally bound by it.
• Order a price reduction of any good/service which is the subject matter of the contract.
• Award the consumer damages which the court considers reasonable.
• Take any other remedy the court considers reasonable under the circumstances.

Additionally, consumers are able to seek interim and final measures pursuant to Article 62 of the law and a trader may be ordered, among other things, to:

• immediately terminate and/or refrain from repeating the infringing acts;
• take remedial action, at the discretion of the court with a view at remedying the unlawful behaviour; or
• publish all or part of the court judgment or publish a remedial statement with a view to rectifying the continuing effects of the breach.

During the past 12 months the CPS has examined, inter alia, various cases, as follows.

• Breach of the CP Law 2021 by an influencer – the CPS imposed an administrative fine of EUR2,000 on an influencer who, with his posts in question, falsely created the impression that he was not acting for purposes related to his commercial activity or was falsely impersonating the consumer.
• Several cases regarding specific commercial practices which, including their overall presentation, deceived – or were likely to deceive – the average consumer as to the existence of a special price advantage and led – or were likely to lead – the average consumer to make a transactional decision that they would not have taken otherwise.

Overall, it seems that, due to recent legislation, several changes are set to emerge regarding deceptive advertising and advertising in general as there are now new means of advertising that are being used, and advertisers are applying new technologies and platforms to reach their target audiences. The Digital Services Act aims to regulate online platforms and services and will have a significant impact on advertising as it introduces several new restrictions and requirements for online platforms.

Advertising is becoming more data driven and personalised, and advertisers will need to abide by the requirements of the GDPR when processing personal data.

The standards that apply to all advertising claims, as stipulated in the CP Law 2021 and CARO’s Code, should be followed.

There have been no changes in the political climate or administration that have impacted the regulation of advertising and/or the enforcement of advertising regulations.

Law on Consumer Protection

The CP Law 2021 regulates unfair commercial practices (Part II), as well as misleading and comparative advertising. The Law prohibits unfair commercial practices and defines these as those which go against the requirements of professional diligence and/or distort, or are likely to substantially distort, the purchasing behaviour of the average consumer, and/or are misleading and/or are aggressive.

More specifically, the Law lists certain practices that are considered to be misleading under any circumstances, such as falsely claiming to be signatory to a code of conduct, represent unauthorised use of a quality, certification, or other similar mark, or claim that a good can increase the chances of winning in games of chance.

Furthermore, the CP Law 2021 defines both misleading actions and misleading omissions which are considered unfair commercial practices and are therefore prohibited.

A misleading action occurs when an advertising practice misleads through the information it contains or is presented in a manner that is likely to cause deception (even if the information is factually correct) and causes, or is likely to cause, the average consumer to make an alternative transactional decision.

If a trader omits material information or is presents information with a lack of clarity, with incoherence, in an untimely or ambiguous manner, or does not mention the commercial intent of a practice, if not already evident, and if this results in, or is likely to result in, the average consumer making a different transactional decision, it is inferred that this omission is misleading.

Advertising Ethics Code

Similar considerations are stipulated in CARO’s Code, according to which all marketing communications must be truthful and not misleading. Marketing communications should not contain any statement or claim which, directly or by implication, omission, ambiguity, or exaggeration, is likely to mislead the consumer, with regard to:

• the material characteristics of a product, such as:
1. its nature;
2. its composition;
3. the method and date of its manufacture;
4. its range of use;
5. its efficiency; and
6. its performance;
• the value of the product and the total price to be paid by the consumer;
• the terms for the product’ delivery, return, repair, and maintenance;
• intellectual property rights such as patents, trade marks, designs and models, and trade names; and
• official recognition or approval, including awards such as medals, prizes, and diplomas.

All advertising claims are subject to regulation to the extent that they constitute unfair commercial practices or are contrary to the provisions of the CP Law 2021. However, certain exceptions may apply, depending on the facts of each case. Most notably, the CP Law of 2021 specifies that a statement that was so clearly untrue that it was not intended to be believed would not be considered as unfair commercial practice. There is no absolute requirement for empirical evidence before implied claims are determined by the courts/regulators, though such evidence would carry extensive persuasiveness. The courts/regulators implement an approach whereby advertisements are examined based on what the average consumer would understand claims to mean.

In accordance with the CP Law 2021, it is a requirement for advertisers to be able to substantiate advertising claims when they are investigated by the CPS and, for this purpose, they must have in their possession the documentary evidence required to establish a true and accurate claim. This is aligned with the obligation that advertising claims are honest and are not misleading to customers. There is no distinction as to the type of substantiation necessary based on the nature of the claim.

CARO’s Code stipulates that advertisers should be able to substantiate any claims made in their advertisements and, where testimonials are used, they must be authentic and centred on personal experience. As to claims for categories of goods such as food and beverages, all nutritional and health-benefit information should be reinforced by a complete scientific basis.

Product demonstrations are subject to similar standards as all advertising claims, as stipulated in the CP Law 2021 and CARO’s Code.

CARO’s Code provides that advertisers should be able to substantiate any claims made in their advertisements and, where testimonials are used, they must be authentic and centred on personal experience. It is also worth mentioning that, under the Broadcasting Code of the RDSA, testimonials by children for advertising products addressed to children are not permitted.

CARO’s Code contains specific provisions on environmental claims and a new chapter on environmental claims in advertising has been adopted, which should be read in conjunction with the general Advertising Code. The chapter contains detailed information as to what is expected in terms of information for environmental claims. There is a general provision that advertisements should not encourage behaviour that is contrary to what is generally considered as acceptable environmentally friendly behaviour. The following should be noted with regards to environmental claims.

• Environmental signs or symbols should be used in marketing communication only when the source of those signs or symbols is clearly indicated and there is no likelihood of confusion over their meaning.
• Environmental claims should not be presented in such a way as to imply that they relate to more stages of a product’s life cycle, or to more of its properties than are justified by the evidence.
• Claims such as “environmentally friendly” or “ecologically safe”, implying that a product or an activity has no impact – or only a positive impact – on the environment, should not be used unless a very high standard of proof is available.
• Any comparative claims should be specific, and the basis for comparison should be clear. Environmental superiority over competitors should be claimed only when a significant edge can be demonstrated. Products being compared should meet the same needs and be intended for the same purpose.

According to the CP Law 2021 In the context of an invitation to purchase, the following information is considered indispensable, unless it is inherently evident within the specific circumstances.

• Product characteristics – the primary attributes of the product, to the extent that these are pertinent concerning the communication medium employed and the nature of the product.
• The trader’s identity – the geographical address and identification of the trader, encompassing its trade name. Additionally, where applicable, the geographical address and identity of the trader on whose behalf the trader acts must be detailed.
• Pricing details – the price of the product, inclusive of taxes. In instances where, due to the product’s nature, determining the price in advance is not reasonable, the methodology for calculating the price must be specified. Furthermore, if applicable, all supplementary charges should be included, such as shipping, delivery, postage, or any additional fees that cannot reasonably be computed in advance, along with a disclosure of the potential requirement for such additional charges.
• Transaction terms – the terms governing payment, delivery, and performance, particularly if these deviate from commonly accepted standards of professional conscientiousness.
• Right of withdrawal or cancellation – for products and transactions where a right of withdrawal or cancellation exists, the acknowledgment of this entitlement.
• Online market information – in cases where products are offered within online markets, there should be clarification on whether the third party presenting these products qualifies as a merchant or not, relying on the declaration provided by said third party to the online market provider.

There are certain advertising claims which are specifically regulated, particularly in relation to the following industries.

Food

Any claim made in relation to the nutritional elements of food products must comply with the requirements of Regulation (EC) No 1924/2006. For example, when claiming that a product is high in fibre, certain information must be provided to the consumer in that regard. Furthermore, Regulation (EU) 1169/2011 concerns food information to be provided to consumers and establishes general principles to be followed, particularly with regards to labelling.

Food Supplements

Secondary legislation, namely Order 449/2004, which implements Directive 2002/46/EC, provides that no person is allowed, without the prior permission of the Director of the Public Health Service of the Ministry of Health, to publish any advertisement that intends to promote food supplements on the market for consumer purposes.

In general, any advertisement for food supplements must not contain any allegation that a balanced diet cannot be a source of suitable nutrients in general. It is prohibited in any advertisement that promotes food products relating to weight loss to make any reference to the time required or range of weight that can be lost due to the use of the product or any reference that this food product can lead to reduced hunger.

Medicinal Products

Law 70/2001, which transposes Directive 2001/83/EC, prohibits certain claims to consumers in relation to medicinal products in the context of advertising – eg suggesting that the effects are guaranteed, without any adverse reactions, or that they are better and more effective compared to other treatments or products.

Other

Any labelling of organic products must be in accordance with Regulation (EC) No 834/2007. With respect to protected designations of origin, protected geographical indications and traditional specialties, the provisions of Regulation (EU) No 1151/2012 shall be followed.

CARO’s Code provides that advertisements must not defame, disparage, or seek to ridicule any person or group of persons, other advertisers, or any company, organisation, industrial or commercial activity, profession, or product.

CARO’s Code includes guidance notes on the topic of advertising to children. In addition, the Digital Services Act bans targeted advertising towards minors based on profiling. Furthermore, under the Broadcasting Code of RDSA, there are many provisions aimed at regulating advertisements addressed to children including the time of advertisement, the products to be advertised, the expectations to be created through the advertisement, and testimonials.

According to the Digital Services Act (DSA) which applies to all platforms since 17 February 2024, “Providers of online platforms shall not design, organise, or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions”.

In addition to the DSA, there are other laws in the EU that may apply to Dark Patterns in advertising. For example, the GDPR mandates that the collection of data should be lawful, fair, and accurate. The CP Law 2021 prohibits unfair commercial practices, such as making false or misleading claims about a product or service.

It is recommended that the general rules and regulations regarding misleading advertising in Cyprus should be observed and influencers should disclose whether there is a material relationship with a brand or advertising agency. CARO has recently introduced guidelines for influencer marketing, making the landscape more transparent and regulated for both influencers and consumers.

There are no special rules applicable to native advertising.

In Cyprus, comparative advertising is permissible in accordance with the provisions of the CP Law 2021 which permits identifying a competitor. We note that statements must not be misleading or defamatory for the products or services of a competitor. In addition, an advertisement must not create confusion between the products, trade marks, trade names, or other distinguishing marks of the advertiser and a competitor. Products or services being compared must meet the same needs or be intended for the same purpose.

A comparative advertisement must objectively compare one or more characteristics which are material, relevant, verifiable, and representative of the said products or services, and price can also be one of these characteristics. Finally, for products with designation of origin, the advertisement must relate to products with the same designation.

According to the CP Law 2021, comparative advertising is permitted when the following conditions are met.

• Comparative advertising is not misleading under the provisions of the CP Law 2021.
• The advertisement compares goods or services that meet the same needs or have the same objectives.
• The advertisement objectively compares one or more characteristics that are material, relevant, ascertainable, and representative of the goods and services in question, which may include price.

Comparative advertising for specific products or services is not permitted when, in accordance with the provisions of any other Law, advertising for such products or services is prohibited. Comparative advertising is also not permitted when advertising professional services may be prohibited or limited, in accordance with the provisions of any other Law.

According to CARO’s Code, advertisements containing comparisons are permitted only so long as they do not have the effect of defaming a competitor’s trade marks, trade names or other distinguishing marks. In general, and according to the same Code, advertisements must not make any unnecessary use of the name, initials, logo, and/or trade marks of another company, business, house, institution or organisation. Advertisements must not in any way take advantage of the good reputation of another company, product, person, or organisation, as embodied in the name, trade marks, or other intellectual property, and must not take advantage of the favourable impression created by another advertising campaign without prior approval.

There are three ways advertisers may choose to challenge claims made by competitors.

• Initiate a civil court action seeking interim and final relief, and a trader may be ordered, among other things, to:
1. immediately terminate and/or refrain from repeating the infringing acts;
2. take remedial action, at the discretion of the court; and/or
3. publish all or part of the court judgment or publish a remedial statement with a view to rectifying the continuing effects of the breach.
• File a complaint with the CPS which may, in turn, order the competitor to take remedial action such as to amend the advertisement or prohibit its publication of the advertisement, impose fines in case of non-compliance, or even initiate proceedings for court measures against the competitor, including injunctions. Nonetheless, according to the CP Law 2021, the CPS, before examining any complaint for comparative advertising, may ask the advertiser to indicate whether any other available mechanisms, such as self-regulation, have been utilised and whether the complaint had been dealt effectively under such mechanisms.
• Advertisers may file a complaint before CARO in relation to any claim made by a competitor. Where CARO agrees with the complainant it may request that the advertisement is either withdrawn or modified. (See 1.4 What Is Advertising? for the effectiveness of CARO’s remedies.)

Furthermore, the CP Law 2021 has enabled advertisers to directly seek court remedies in respect of comparative advertisements. The authors expect that in the coming years advertisers may seek to utilise these remedies more frequently.

Cyprus does not have specific legislation directly related to ambush marketing. Due to this, ambush marketing is not prohibited per se. However, there are methods and alternatives to prevent ambush marketing, mainly by marketers ensuring contractual safeguards or having to rely on relevant general laws.

Most notably, within the CP Law 2021, the best protection against ambush marketing lies in the contractual terms which regulate the rights of event organisers to offer spaces for an event to third parties for their marketing causes.

It is also highly recommended that sponsors should insist that the advertisements in the vicinity of an event are strictly regulated through a contract and focus on the exclusivity of their sponsorship in order to limit access to other competitors.

Advertisers engaged in social media advertising should adhere to the Regulation and CARO’s Code.

In addition, as discussed above (see 1.2 Enforcement and Regulatory Authorities), regarding video-sharing platforms, the RDSA has been entrusted with the role of supervising those platforms that are established in Cyprus. As a result, RDSA is responsible for checking compliance of the video-sharing platforms with the provisions of the Audiovisual Media Services Directive, as implemented. In short, the most important requirements to be observed for advertisements on video-sharing platforms are that:

• advertisements must be readily recognisable as such;
• advertisements for cigarettes and other tobacco products, as well as for electronic cigarettes and refill containers, are prohibited;
• advertisements for alcoholic drinks must not be aimed at minors or encourage immoderate consumption;
• advertisements for prescription medicines are prohibited; and
• sponsored programmes must be identified as such.

The GDPR, which already establishes, for example, rules on users’ consent and their right to object to targeted digital marketing, is supported by the Digital Services Act, which covers all forms of advertising, including political ads, issue-based advertising, and digital marketing.

The Cypriot courts have not explicitly examined the liability of advertisers for user-generated content.

However, the approach considered by the Cypriot courts regarding the liability of website owners with respect to defamatory content may be useful. In the leading case of Christos Clerides and others v Arktinos Publishings Ltd 5208/2010, dated 31 January 2017, the court assessed the responsibility of the host within the user-generated context by reference to degree of control over user-generated content, the actions taken once the host became aware of a complaint in relation to the content, and the nature of the content itself.

It should also be noted that, according to the Law of Services of the Information Society and, in particular, the Electronic Commerce Law, as well as the Related Matters Law of 2004, a service provider can benefit from the exemptions for “mere conduit” when they are in no way involved with the information transmitted. This requires that they do not modify the information that they transmit.

At present there are no exceptions to disclosure requirements for advertising in social media, notwithstanding any space limitations. However, it is recommended that advertisers should include “#AD” at the beginning of advertisements, irrespective of the social media platform.

The DSA will impose special obligations to major online platforms (with followers of 45 million or more) which, inter alia, will include enhanced transparency, auditing requirements, advertising, data sharing with the relevant authorities, and appointing a specific compliance officer.

The General Data Protection Regulation (EU) 2016/679 (GDPR) and the Cyprus Personal Data Law (Law 125(I)/2018), which implemented certain provisions of the GDPR and repealed the Processing of Personal Data (Protection of Individuals) Law 138 (I)/2001, are the two main pieces of legislation that regulate personal data processing in Cyprus. Under the GDPR, an entity that uses direct marketing, and specifically email marketing methods, will first need a legal basis in order to proceed and process personal data. In this case, consent is the appropriate legal basis, while there are several exceptions determining whether the entity is permitted to send emails to customers without asking for their consent.

e-Privacy Directive

The Electronic Communications and Postal Services Law 112 (I) of 2004 (the “Privacy Communications Law”) implements the Directive on Privacy and Electronic Communications (2002/58/EC) (as modified) in Cyprus. Email marketing, which is considered as a direct marketing method, is regulated under the Privacy Communications Law and requires an opt-in consent before processing a data subject’s personal information. However, if the data subject’s information was collected during the provision of services in the past and the individual was given the ability to opt out, emails may be sent on an opt-out basis, as long as the marketing relates to similar products/services for which the data subject’s details were originally collected.

The Cyprus Personal Data Commissioner may impose a fine for infringements of up to EUR20 million, or 4% of annual global turnover, whichever is greater.

Under the Radio and Television Broadcasting Stations Law of 1998 (as amended), which regulates telemarketing activities, it is clearly stated that the transmission of telemarketing messages is prohibited during children’s programmes. The sale of pharmaceutical drugs through telemarketing is also prohibited.

In relation to the sale of alcoholic beverages through telemarketing methods, the Law stipulates, inter alia, that interested companies ensure that this should not be directed towards minors, should not depict minors consuming such beverages, should not encourage the excessive consumption of alcoholic beverages, and should not provide a negative impression of their abstinence from consumption or their measured consumption.

A violation of the above provisions may result in a fine of EUR8,500 by the RDSA for every day that the violation takes place.

According to the guidance published by the Cypriot Data Protection Commissioner, call centres can use the numbers listed in the telephone directories or random dialling of telephone-number systems, without the consent of the data subject, when this does not entail a promotional action for a specific product or other advertising purpose. This is not the case when the activities of call centres entail advertising, or when there is a need to store the personal information of the data subjects, in which case consent must be obtained first.

In all instances, call centres will need to inform the data subjects regarding the details of the processing. Data subjects should be informed beforehand regarding the details of the controller, the purpose of the call, the recipients, and their rights according to Article 11(1) of the GDPR, and be provided with the means for the exercise of their right to refuse to receive calls in the future as well as in the continuation of the current call.

Direct marketing includes text messages (SMS) and emails that a customer receives from a service.

Depending on the specific circumstances, the available legal grounds for targeted advertising are consent and legitimate interests. According to recent guidance published by the European Data Protection Board (EDPB) in order for the ground of “legitimate interests” to apply, the following conditions should be satisfied:

• there is a legitimate interest pursued by the controller or a third party;
• it is necessary (prior examination is needed as to whether less invasive methods are available); and
• a balancing test is applied examining whether the act is proportional, ensuring that the legitimate interest is not overridden by the individual’s fundamental rights and freedoms.

When marketeers resort to the marketing methods of profiling and tracking across various websites, devices and locations, they should consider consent as being the most appropriate legal basis. However, the use of consent should not be considered as an all-round solution, and will not be deemed to be valid grounds for any disproportionate or unfair processing of personal data.

According to the E-Privacy Directive (EC 2002/58/E), consent, as opposed to legitimate interests, is the applicable legal basis for the use of Cookies, pixels and tags. It should be further noted that the use of pre-ticked boxes or scrolling through a website would not suffice as valid consent, and that any subsequent processing of personal information must also rely on consent.

In accordance with Article 26(2) of the GDPR, controllers who wish to resort to targeted advertising methods must inform the data subjects beforehand about any agreements with other controllers, be transparent about all aspects of their processing activities, and provide the means to the data subjects to exercise their rights.

Τhe Cyprus Personal Data Commissioner may impose a fine for infringements of up to EUR20 million, or 4% of annual global turnover, whichever is greater.

Furthermore, according to the Digital Services Act, users will need to receive more information when an ad targets them specifically.

According to the Children’s Law (CAP 352), a child is a person under the age of 18 years. There are specific provisions which apply with respect to marketing of goods/services to children, in industry-specific legislation and in CARO’s Code.

Personal data is defined in the GDPR and the definition which is adopted in the Cypriot Personal Data Law 125(I)/2018 means any information relating to an identified or identifiable natural person, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

The GDPR and the Cypriot Personal Data Law have specific provisions relating to the conditions which need to be satisfied in order to obtain a child’s consent in relation to information society services. The GDPR prescribes that the age threshold for obtaining the valid consent of a child is 16, whereas the Cypriot Personal Data Law provides that, in order for the processing of the personal data of a child under the age of 14 to be lawful, the consent of their custodian or legal representative is needed.

It should also be noted that the Digital Services Act bans targeted advertising of minors based on profiling.

Before collecting and using people’s personal data for advertising purposes, advertisers must have their explicit, informed consent. Advertisers are required to be honest about data processing procedures, including the reasons for processing and the duration of data retention. Under GDPR, people have more rights, such as the ability to view, correct, delete, or transfer their data. Advertisers are required to support these rights, and to obtain user permission before installing non-essential Cookies on a user’s device, according to the E-Privacy Directive also. These regulations are expected to be reinforced and better harmonised by the upcoming E-Privacy Regulation.

The main criterion for whether a sweepstake or chance-based contest is permitted or not depends on whether a participation or registration fee is necessary. If the sweepstake requires any form of consideration to be paid by participants, this activity is likely to be classified as a lottery which is expressly prohibited pursuant to the Lotteries Law (Cap 74).

Lotteries in general are not permitted under Cypriot Law, unless they fall in the following exceptions:

• government lotteries;
• small lotteries in which the proceeds will be allocated for charitable purposes; and
• private lotteries within organisations which are limited to employees of the organisation.

Apart from the possibility of the chance-based contest being classified as a lottery, sweepstakes are, to a large extent, unregulated. However, the general advertising framework and provisions ensuring the protection of consumers should be followed. Additionally, any collection and processing of personal data should adhere to the GDPR and the Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data of 2018. The purpose of using the data collected must be clearly defined and the consent requirements provided by the GDPR should be observed.

Cypriot legislation is silent with respect to games of skill. Absent any express legislation, it is understood that games of skill are the opposite of games of chance. Whereas the winner of a chance-based game is determined by luck, skill-based games are those in which the winner is determined based on a physical or mental attribute and requires the active participation of the individual.

In circumstances where the winner is selected partly by a skill-based method and partly by a chance-based element, this may constitute and infringement of the Lotteries Law provided that the word “lottery” is widely defined as any “scheme for distributing prizes by lot or chance”. The same considerations regarding consumer and data protection in respect of sweepstakes will also apply to skill-based contests.

The present Cypriot legal framework does not provide rules mandating any government/regulatory body registration pre-approvals with respect to skill-based contests.

As described above, all lotteries are unlawful. Therefore, any chance game which falls in the definition of lottery is prohibited. The exception permitted by law with regards to charitable raffles requires express permission from the Minister of Finance.

An example of an unfair practice, according to the CP Law 2021 which is expressly regulated, is where a product is described as “gratis”, “free”, “without charge”, or similar, if the consumer must pay anything other than the unavoidable cost of responding to the commercial practice and collecting or paying for delivery of the item.

According to Article 36(7) of the CP Law 2021, a consumer may request an appropriate price reduction or withdraw from the contract if:

• neither repair nor replacement is possible;
• only repair is possible, but it failed;
• the seller did not complete the repair within a reasonable time; or
• the seller did not complete the repair.

Pursuant to Article 45 of the Law, the seller who is selling at a discounted price shall ensure that:

• the current selling price; or
• the percentage of reduction,

has a general notice of the reduction which is clearly identifiable and is related to the product, is certainly clear, and is sufficient for understandability.

Annex IV of the CP Law 2021 contains a non-exhaustive list of clauses that could be considered as being abusive – eg, a clause which “automatically extends the validity of a fixed-term contract, in the absence of a consumer declaration to the contrary, where the deadline for not extending the contract has been set at a date which is too remote in relation to the actual contract termination date”. Consequently, whilst such a contract is theoretically possible, this sort of clause may breach the CP Law 2021.

The European Commission initially proposed a legal framework for artificial intelligence (AI) on 21 April 2021. Regulation (EU) 2024/1689 (“the AI Act”), which entered into force on 1 August 2024, provides a definition of AI systems that is not constrained by specific technology. Additionally, it adopts a risk-based strategy that outlines set demands and obligations for the creation, entry into the market and application of AI systems within the EU.

Companies using AI should also follow the rules which are included in the GDPR and other legislation intended to safeguard people when their personal data is processed. In order to operate, AI systems frequently need access to enormous volumes of data, some of which may contain personal data. The GDPR establishes standards and demands for companies using AI to ensure that individuals’ privacy rights are protected.

According to the AI Act, providers must ensure that AI systems interacting directly with natural persons are designed and developed in such a way to as inform users that they are interacting with an AI system, unless this is obvious to a reasonably well-informed person, observant, and circumspect – taking into account the circumstances and the context of use.

Transparency obligations for providers and deployers of certain AI systems provided by the AI Act should be followed (see 8.2 AI-Related Claims.)

The regulation that governs the advertising of crypto-assets is the Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA).

Amongst other things, it requires the provision of clear and concise information to clients and persons interested in crypto-assets defined in the Regulation. Information contained in the crypto-asset White Paper as well as in the relevant marketing communications, such as advertising messages and marketing material, and including through new channels such as social media platforms, should be fair, clear, and not misleading. Advertising messages and marketing material should be consistent with the information provided in the crypto-asset White Paper.

There are currently no specific laws or regulations in Cyprus that apply to advertising within the metaverse.

Human clinical studies are impliedly necessary for making advertising claims, as a result of the provisions of the Medicinal Products for Human Use Law 70(I)/2001 whereby no medicinal or cosmetic product can be advertised without having obtained a marketing authorisation first by the Cypriot Pharmaceutical Authorities.

Any claim made in relation to nutritional elements of food products must comply with the requirements of Regulation (EC) No 1924/2006. For example, when claiming that a product is high in fibre, certain information must be provided to the consumer in that regard. Furthermore, Regulation (EU) 1169/2011 regulates food information to be provided to consumers, and establishes general principles to be followed, particularly with regards to labelling.

As per the provisions of the Audiovisual Media Services Directive which has been transposed into national law under the Radio and Television Broadcasting Stations Law of 1998 (as amended), product placement is allowed, except in the following types of programmes.

• news and current affairs;
• consumer affairs;
• religious programmes; and
• children’s programmes.

In addition, programmes must not give undue prominence to the product in question.

Viewers must be clearly informed of the existence of product placement by an appropriate identification, and any product for which its advertisement is prohibited, such as tobacco, cannot be promoted through product placement.

In March 2021, secondary legislation was enacted regarding animal welfare. Under this legislation, pets cannot be sold or advertised for sale except by licensed pet shops, and only for certain domestic animals listed in the legislation.