Bulgaria's cookie rule is Article 4a of the Electronic Commerce Act (Закон за електронната търговия), and the Commission for Consumer Protection (КЗП) enforces it, not the data protection authority. The Commission for Personal Data Protection (CPDP, КЗЛД) enforces the GDPR for any personal data those cookies collect. Because Article 4a requires the information the GDPR prescribes, non-essential cookies in practice need opt-in consent from Bulgarian visitors before they are set.
Two laws and two regulators cover cookies in Bulgaria
Bulgaria applies two overlapping legal instruments to cookies and similar tracking technologies. The GDPR governs the processing of personal data collected through cookies, while Article 4a of the Electronic Commerce Act transposes Article 5(3) of the ePrivacy Directive into Bulgarian law. Each has its own supervisor: the Commission for Consumer Protection oversees the Electronic Commerce Act (Article 20), and the CPDP oversees the GDPR.
Article 4a allows a provider to store or read information on a visitor's device only if the visitor has received clear and comprehensive information under Article 13 of the GDPR and has been given the opportunity to refuse. Cookies needed to transmit a communication, or to provide a service the visitor explicitly asked for, are exempt.
The wording still speaks of a chance to refuse, which reads like an opt-out. But consent to cookies follows the GDPR standard, and the CJEU's Planet49 ruling (C-673/17) held that pre-ticked boxes and silence are not consent. For website owners, the practical effect is clear: non-essential cookies require prior consent from Bulgarian visitors before they are set.
Who enforces what: the КЗП and the CPDP
The Commission for Consumer Protection (Комисия за защита на потребителите, КЗП) has overall control of the Electronic Commerce Act. Its officials draw up the reports on breaches, and its chair issues the penalty decisions (Article 25). Breaching Article 4a is a matter for this commission, whether or not the cookie collects personal data.
The CPDP (Комисия за защита на личните данни, КЗЛД) has supervised data protection in Bulgaria since 2002. It handles complaints, conducts investigations, issues guidance and imposes administrative fines under both the Bulgarian Personal Data Protection Act (Закон за защита на личните данни) and the GDPR. Most CPDP proceedings begin with complaints from data subjects. Where cookies collect personal data without a legal basis, the CPDP can act on GDPR grounds.
Fines under the Electronic Commerce Act and the GDPR
Breaches of Article 4a carry fines under Article 24 of the Electronic Commerce Act, imposed by the Commission for Consumer Protection. The Act sets them in leva: BGN 250 to 1,500 for an individual, and a property sanction of BGN 500 to 2,000 for a company or sole trader, rising to BGN 500 to 2,500 and BGN 1,000 to 4,000 for a repeat breach.
Bulgaria adopted the euro on 1 January 2026, at the fixed rate of EUR 1 to BGN 1.95583. At that rate, the company sanction for a first breach comes to about EUR 256 to 1,023.
GDPR fines from the CPDP come on top where personal data is processed: up to EUR 20 million or 4% of annual global turnover under Article 83 of the GDPR. That ceiling, not the Electronic Commerce Act's, is the real exposure for a site that tracks visitors without consent.
What a Bulgarian cookie banner needs
Bulgarian law adds no banner rules of its own beyond Article 4a. The GDPR consent standard and the shared position of EU authorities in the EDPB's cookie banner taskforce report of 18 January 2023 set what a banner should do:
No pre-selected categories: cookie categories (except strictly necessary) must not appear pre-ticked or visually emphasised to steer users toward acceptance
Genuine choice to refuse: visitors must be able to decline all non-essential cookies without losing access to the website
Individual category selection: users should be able to accept or reject cookies by category (for example analytics, marketing, functional)
Equal prominence for accept and reject options: consent is not valid if refusing is harder than accepting
If a website offers no way to refuse cookies, consent cannot be regarded as freely given under Article 7 of the GDPR.
Cookie categories in practice
The standard cookie categories used across EU member states apply in Bulgaria too:
| Category | Consent required? | Examples |
|---|---|---|
| Strictly necessary | No | PHPSESSID, csrf_token, load balancer cookies |
| Functional or preferences | Yes | Language and theme preferences |
| Analytics or statistics | Yes | _ga, _ga_*, Matomo cookies |
| Marketing or advertising | Yes | _fbp, _gcl_au, retargeting pixels |
Only strictly necessary cookies may be set without consent. Everything else requires an affirmative opt-in before the cookie reaches the visitor's browser.
CPDP enforcement record and notable fines
Bulgaria's most significant data protection fine targeted the National Revenue Agency (NRA) in 2019. The CPDP imposed a penalty of about EUR 2.6 million (BGN 5.1 million) after a cyberattack exposed personal data belonging to more than five million individuals. The violation centred on inadequate technical and organisational measures under Article 32 of the GDPR.
Most enforcement actions have targeted violations of data processing principles (Article 5 GDPR), insufficient legal basis for processing (Article 6 GDPR) and failures to respond to data subject access requests. Cookie-specific fines in Bulgaria remain less common than in member states such as France or Spain, but the trend across Europe points toward increasing scrutiny of tracking technologies.
How Bulgaria compares to neighbouring EU states
Bulgaria's cookie rules are broadly consistent with other EU member states, but enforcement intensity varies. Neighbouring Romania and Greece have seen more cookie-specific enforcement actions in recent years. Croatia, where the telecom regulator HAKOM supervises the cookie rule, also splits the job between two authorities.
The global compliance hub sets Bulgaria beside the other EU countries and the rest of the world.
Compliance checklist for Bulgarian cookie consent
Use this checklist to evaluate your website against the Bulgarian rules:
Audit your cookies: run a cookie scan to identify every cookie and tracker on your site, including those set by third-party scripts
Classify each cookie: assign every cookie to the correct category (necessary, functional, analytics, marketing)
Show a consent banner: display a banner that loads before non-essential cookies fire, with clear accept and reject buttons of equal prominence
Block scripts until consent: make sure analytics tags like
_gaand marketing pixels like_fbpdo not run until the visitor opts inSupport granular choice: allow visitors to select individual cookie categories rather than forcing an all-or-nothing decision
Provide a cookie policy: publish a clear policy listing each cookie, its purpose, duration and whether it is first-party or third-party, as Article 13 GDPR information
Enable consent withdrawal: make it as easy to withdraw consent as it was to give it, using a persistent revisit consent button
Keep consent records: store proof of each visitor's consent decision, including timestamp and categories accepted, in a consent log
Configure geo-detection: if your site serves multiple regions, apply opt-in rules for Bulgarian visitors through region rules
Review regularly: re-scan your site after adding new tools or plugins, as third-party scripts frequently introduce new cookies
Google Consent Mode and Bulgarian visitors
If your site uses Google Analytics 4 or Google Ads, Google Consent Mode v2 is relevant. This framework allows Google tags to adjust their behaviour based on a visitor's consent status. When a Bulgarian visitor declines analytics cookies, Consent Mode can switch to cookieless pings that do not store identifiers on the device.
Consent Mode does not replace the need for a proper cookie banner. It is a technical integration that works alongside your consent setup so Google tags follow the choices made through your banner.
Short answers on Bulgarian cookie rules
Does Bulgaria require cookie consent for all cookies?
No. Strictly necessary cookies, such as session identifiers and authentication tokens, are exempt under Article 4a(4) of the Electronic Commerce Act. All other cookies, including analytics and marketing trackers, need prior opt-in consent from the visitor.
Which authority enforces cookie rules in Bulgaria?
Two do. The Commission for Consumer Protection (КЗП) supervises Article 4a of the Electronic Commerce Act, the cookie rule itself. The CPDP (КЗЛД) enforces the GDPR and the Personal Data Protection Act for the personal data cookies collect.
Can my website be fined for not having a cookie banner in Bulgaria?
Yes. Setting non-essential cookies without the required information and choice breaches Article 4a of the Electronic Commerce Act, fined by the Commission for Consumer Protection under Article 24. If the cookies process personal data without a legal basis, the CPDP can add a GDPR fine of up to EUR 20 million or 4% of global annual turnover.
Is a cookie wall allowed under Bulgarian law?
Under the GDPR consent standard, consent is not freely given if refusing cookies costs the visitor access to the website. EU authorities, in the EDPB's consent guidelines, treat a cookie wall that blocks the content on refusal as invalid consent.
How does Bulgaria's cookie law differ from the GDPR?
The GDPR covers personal data processing generally. Article 4a of Bulgaria's Electronic Commerce Act specifically addresses storing information, including cookies, on a visitor's device, transposing Article 5(3) of the ePrivacy Directive. Both apply at the same time when cookies collect personal data, each with its own regulator.
Do I need a Bulgarian-language cookie banner?
There is no strict legal requirement for Bulgarian-language banners, but providing one is strongly recommended if your audience is mainly Bulgarian. The GDPR requires that consent information be provided in clear, plain language that the visitor can understand.
Know exactly what your website stores
Most sites set more cookies than their owners expect. Run a scan to see the full picture, then let Kukie.io sort the cookies into categories, ask Bulgarian visitors before optional ones load and keep a record of each choice.
