In October 2025, Romania's data protection authority completed an investigation into There's An AI For That SRL and fined it RON 30,000, about EUR 6,000, because its website activated non-essential cookies without asking for consent first. The rule it enforced is Article 4(5) of Law 506/2004, Romania's transposition of the ePrivacy Directive: cookies that are not strictly necessary need clear information and prior consent. The authority, ANSPDCP, enforces both that law and the GDPR.
Romania's cookie law framework: GDPR and Law 506/2004
Romania applies two overlapping legal instruments to cookie consent. The GDPR governs the processing of personal data collected through cookies, while Law 506/2004 transposes the ePrivacy Directive (Directive 2002/58/EC) into Romanian law. Together, they create a dual obligation: cookies that store or access information on a user's device require prior consent under Law 506/2004, and any personal data those cookies collect must be processed in line with GDPR principles.
Law 506/2004 specifically addresses the processing of personal data and the protection of private life in the electronic communications sector. Article 4(5) of the law mirrors Article 5(3) of the ePrivacy Directive, requiring that website operators inform visitors and obtain their consent before placing non-essential cookies on their device.
Strictly necessary cookies, those required for a service the user has explicitly requested, remain exempt from this consent requirement.
ANSPDCP enforces the cookie rules in Romania
The Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) is Romania's data protection authority. It supervises compliance with both the GDPR and Law 506/2004, investigates complaints, conducts audits, and issues fines.
The ANSPDCP has been one of the more active DPAs in Central and Eastern Europe, and since 2025 it has fined several website operators specifically for cookies placed without consent. Most of its cookie cases start with a complaint from a visitor.
Consent requirements under Romanian law
Valid cookie consent in Romania must satisfy both the GDPR standard (Article 7) and the ePrivacy standard under Law 506/2004. The practical requirements are:
Prior consent: non-essential cookies (such as
_ga,_fbp, or advertising trackers) must not be set before the user actively consents.Informed: the user must receive clear information about what cookies are used, their purpose, and who receives the data.
Freely given: consent cannot be bundled with terms of service or forced through dark patterns. Cookie walls that block access unless the user accepts all cookies do not produce freely given consent in the EDPB's view.
Specific: users should be able to accept or reject cookies by category (for example analytics, marketing, functional).
Easy withdrawal: withdrawing consent must take no more effort than giving it.
Pre-ticked checkboxes, implied consent through continued browsing, and consent obtained by deceptive banner design all fail to meet these standards.
ANSPDCP cookie fines in 2025
The ANSPDCP can impose fines under two regimes. For GDPR violations, penalties can reach EUR 20 million or 4% of global annual turnover. Breaches of Law 506/2004 carry their own fines in lei, far lower in practice, as the recent cookie cases show.
| Penalty regime | Legal basis | Maximum fine |
|---|---|---|
| GDPR (personal data processing) | Regulation (EU) 2016/679 | 20 million EUR or 4% of global turnover |
| ePrivacy (cookie placement) | Law 506/2004, Art. 4(5) | Fines in lei set by the law, recent cookie fines RON 20,000 to 30,000 |
Two 2025 cases show what the ANSPDCP looks for:
There's An AI For That SRL: fined RON 30,000 after an investigation completed in October 2025, for activating non-essential cookies without first asking for explicit consent, in breach of Article 4(5)(a) and (b) of Law 506/2004.
iHunt Technology: the electronics brand was fined RON 20,000 (reported on 22 December 2025) after a visitor's complaint, because its site set cookies that were not technically necessary without adequate information or prior consent.
Neither case turned on an exotic tracker. Both concerned ordinary cookies that loaded before the visitor had a choice, which a scan of the site before consent would have shown.
How Romania compares to neighbouring EU countries
Romania's approach aligns closely with the general EU model but has some local characteristics worth noting. Unlike Germany, which enacted a dedicated cookie statute (TDDDG) to replace its older Telemediengesetz provisions, Romania still relies on the 2004 transposition without significant updates.
Compared to Hungary and Bulgaria, Romania has issued more total GDPR fines. Poland's UODO has taken a similar enforcement trajectory, though with higher individual fine amounts in some cases.
| Country | DPA | ePrivacy transposition | Cookie enforcement activity |
|---|---|---|---|
| Romania | ANSPDCP | Law 506/2004 | Active: several cookie fines in 2025 |
| Bulgaria | Commission for Consumer Protection (cookie rule), CPDP (GDPR) | Electronic Commerce Act, Art. 4a | Moderate |
| Hungary | NAIH | Act C of 2003 | Moderate |
| Poland | UODO and UKE | Electronic Communications Law (2024), Art. 399 | Active |
The common thread across all four countries is that GDPR Article 7 sets the consent standard, and national ePrivacy laws govern the technical act of storing cookies on a device. If your site serves visitors from multiple EU countries, multilingual consent and geo-detection become practical necessities. The global compliance hub covers each country.
Checklist for Romanian visitors
Use this checklist to verify your site meets Romanian cookie consent requirements:
Audit your cookies: run a cookie audit to identify every cookie and tracker your site sets. Classify each as strictly necessary, functional, analytics, or marketing.
Block non-essential cookies before consent: scripts that set cookies like
_ga,_fbporfrmust not fire until the user has given consent for the relevant category.Display a clear banner: your cookie banner must offer granular category-level choices, with a visible reject option that is equally prominent as the accept button.
Provide clear information: list the specific cookies, their purposes, expiry periods, and whether third parties receive data. Link to a full cookie policy.
Store consent records: keep a log of when and how each user consented. The ANSPDCP can request proof of valid consent during an audit.
Make withdrawal easy: provide a persistent link or button allowing users to change their preferences at any time.
Respect the choice: if a user rejects analytics or marketing cookies, those cookies must not be set. Verify with a scanner after deployment.
Google Consent Mode and Romanian visitors
If your site uses Google Analytics 4 or Google Ads, Google Consent Mode v2 provides a mechanism to adjust tag behaviour based on the user's consent status. When a Romanian visitor declines analytics cookies, Consent Mode keeps the _ga cookies from being set and sends cookieless pings instead.
Consent Mode does not replace your obligation to present a lawful consent banner. It is a technical integration that works alongside your CMP, not a substitute for one.
Short answers on Romanian cookie rules
What fines can the ANSPDCP impose for cookie violations?
Law 506/2004 sets its own fines in lei: the 2025 cookie cases ended in fines of RON 20,000 (iHunt) and RON 30,000 (There's An AI For That). Where cookies also involve unlawful personal data processing, GDPR fines of up to EUR 20 million or 4% of global annual turnover are possible.
Are cookie walls allowed in Romania?
Cookie walls that block site access unless a visitor accepts all cookies are unlikely to be accepted. The EDPB has stated that consent obtained this way is not freely given, and the ANSPDCP applies the GDPR consent standard.
Do I need a cookie banner if my site only uses strictly necessary cookies?
If your site genuinely sets only strictly necessary cookies required for the service the user requested, consent is not required under Law 506/2004. You should still inform users about these cookies in a cookie policy, but a consent banner is not mandatory.
How do I prove consent to the ANSPDCP during an audit?
Maintain timestamped consent records showing when each visitor consented, what categories they accepted, and the version of the banner they saw. A consent management platform with built-in logging keeps these records for you.
Can I use implied consent or pre-ticked boxes for Romanian visitors?
No. Romanian law requires explicit, affirmative consent. Pre-ticked boxes, implied consent from scrolling, and banners without a reject option do not meet the legal standard.
Find the cookies that load before Romanian visitors choose
Both 2025 fines started with cookies that loaded before consent. Kukie.io scans your site for them, blocks non-essential cookies until visitors choose in a Romanian banner and keeps a record of each choice.
