Bulgaria. ePrivacy / marketing. Act
ECAElectronic Commerce Act (Article 4a) and Electronic Communications Act
Partly verified
Low confidence.Secondary sources disagree whether Art 4a sits in the Electronic Commerce Act or Electronic Communications Act; not verified on official portal.
§1Summary
- Synopsis
Bulgaria implements the ePrivacy cookie and unsolicited communications rules through its e-commerce and electronic communications legislation. Storage or access to terminal equipment needs informed consent unless strictly necessary.
- Key themes
- Unique features
Bulgaria historically maintained an opt-out register for commercial e-mails under the Electronic Commerce Act.
- SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- National up to BGN 5,000 per violation; GDPR fines where personal data processed
§3Dates
- Key dates
- Adopted
- In force
- Cookie consent rule (Art 4a) aligned with ePrivacy Directive 2009 amendments
§4Text and authority
- Text
- Authoritative text cpdp.bg
- Authority
- Commission for Personal Data Protection (CPDP); Communications Regulation Commission (CRC) for telecom
§5Where it applies
- Domestic law of
- Bulgaria
§6Sources and verification
- Verification
Low confidence.
Partly verified
Low confidence.Secondary sources disagree whether Art 4a sits in the Electronic Commerce Act or Electronic Communications Act; not verified on official portal.