Cookie fines in Romania: what Law No 506/2004 requires and what ANSPDCP has sanctioned

What the law provides

Law No 506/2004 transposes Directive 2002/58/EC (ePrivacy) into Romanian law. Under Article 4(5), storing information on a user's equipment and accessing information already stored there are permitted only if two conditions are both met:

• the user has given their agreement;
• before giving it, the user has received clear and complete information, set out in easily understood language, easily accessible and stating the purpose of the processing.

Where the provider allows third parties to store or access information, the notice must also state the general purpose of their processing and how the user can use browser settings or similar technologies to delete the information or refuse third-party access.

Article 4(5¹) adds that agreement may also be given through browser settings or similar technologies from which it can be considered that the user has expressed it. The press releases below do not refer to this provision. The conditions for valid consent, as described by European authorities, are covered in our article on compliant cookie banners.

Article 4(6) provides two exceptions: operations carried out solely to transmit a communication over an electronic communications network, and those strictly necessary to provide an information society service expressly requested by the user.

The limits of the fines

Failing to meet the conditions in Article 4(5) is a contravention under Article 13(1)(i). Article 13(2) sets the penalty:

• General rule: a fine of RON 5,000 to RON 100,000.
• Companies with a turnover above RON 5,000,000: a fine of up to 2% of turnover.

Contraventions are established and sanctioned by authorised ANSPDCP staff, under Article 13(5). Sanctions under Law No 506/2004 can be added to those under the GDPR: in two of the cases below, the Authority also found, in the same investigation, an infringement of Articles 12–14 GDPR on informing data subjects.

The situations described by ANSPDCP

The cases below come from press releases published on the Authority's website between 2022 and 2026. The selection is not a complete list of the sanctions applied, and the press releases do not state whether the sanctions were challenged. We have left out the names of the operators; where they have been published, they appear in the press releases linked.

• 5 February 2026Company

  Fine of RON 101,794 (EUR 20,000)

  A user complained about tracking and behavioural advertising cookies on the site. The fine does not concern the cookies, however: the operator was sanctioned under Article 83(5)(e) GDPR for failing to respond to the Authority's request.

• 18 November 2025Law office

  Fine of RON 20,000

  Between May and October 2025, visiting the operator's websites allowed cookies that were not technically necessary to be installed, without prior consent and without complete and correct information.

• 11 September 2025Company

  Fine of RON 15,000

  From 15 April 2025, cookies that were not technically necessary were stored through the site without clear information and without the explicit consent of data subjects.

• 3 September 2025Individual

  Fine of RON 37,000

  The operator's websites allowed cookies that were not technically necessary to be installed before users gave their consent. The press release also mentions the use of traffic-monitoring technologies to generate and place “malicious advertisements” on users' devices.

• 16 July 2025Individual

  Fines of RON 30,000 and RON 20,286.80 (EUR 4,000)

  Between 6 December 2024 and 3 April 2025, visiting the site made it possible to store and access information through cookies without prior express consent and without informing users. The second fine, based on Articles 12–14 GDPR, concerns the failure to inform people whose data were collected through the contact form.

• 10 December 2024Company

  Fine of RON 10,000 and a warning

  The complaint alleged, among other things, that the site could not be accessed without accepting cookies. ANSPDCP found that information was stored and accessed through cookies without prior express consent and without informing users, and that the information provided under Articles 12–14 GDPR was incomplete. The Authority ordered the operator to obtain consent and inform users before installing cookies, and to provide concise, transparent information, mainly in Romanian.

• 22 December 2022Company

  Warning for cookies

  The company stored cookies that were not technically necessary without users' agreement and without clear and complete information. In the same investigation, it received a fine of RON 49,418 (EUR 10,000) for a separate infringement of Article 32(4) GDPR.

The Authority has been looking at this subject for years. In 2015, it carried out thematic investigations into cookies at public and private sector operators. At the main telecommunications providers, the sanctions totalled RON 68,500.

What the cases have in common

• Complaints: in all six press releases from 2024–2026, the investigation began with one or more complaints.
• Operators: the sanctions did not target companies alone. Two press releases concern individuals and one a law office.
• Conduct: in the cases sanctioned for cookies, the same two situations recur: cookies that are not technically necessary, set without prior consent, and missing or incomplete information.
• Amounts: in the four press releases that link the fine solely to Law No 506/2004, the amounts ranged from RON 15,000 to RON 37,000.
• Dealing with the Authority: the largest fine in this selection was imposed for failing to respond, not for cookies.

Review questions for your store's website

On the basis of the law and the press releases above, a website can be reviewed with the following questions. The list is a working tool, not a guarantee of compliance, and does not replace legal advice.

• First load: in a private browser window, when the site is first opened and before any choice is made, are cookies that do not fall under the Article 4(6) exceptions absent?
• Information: before choosing, do visitors receive clear information about the purpose of cookies, in easily understood language?
• Third parties: does the notice state the general purpose of third-party processing and how visitors can delete the information or refuse third-party access?
• Forms: are people who complete the contact form informed about the processing of their data?
• Requests: are requests from ANSPDCP tracked and answered?

On Shopify

Consentia is a cookie consent app for Shopify stores. Further information is available on the Features page. A website can also be checked with our free cookie scanner.

Related articles

• Advertising pixels and consent: the store owner's responsibility
• What a compliant cookie banner looks like: what the EDPB and the authorities say about buttons and choice
• Consent Mode v2 on Shopify: what data reaches Google and how to control it
• When a visitor rejects cookies: what Google Ads and GA4 still measure

Sources, in Romanian (the summaries above are our own translation): ANSPDCP, Law No 506/2004 · the ANSPDCP press releases linked for each case · ANSPDCP, press release on the 2015 thematic investigations. Photograph: Unsplash.