Privacy Map

Romania. ePrivacy / marketing. Act

Law 506/2004Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector

In force
Partly verifiedLow confidence. Not verified this session.

§1Summary

Synopsis

Law 506/2004 implements the ePrivacy Directive in Romania, requiring consent for cookies and opt-in for unsolicited electronic marketing.

Key themes
  • cookies/terminal equipment consent
  • direct marketing
  • soft opt-in
  • traffic and location data
Unique features

ANSPDCP enforces both the GDPR and the cookie/marketing rules.

SaaS relevance

Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.

§2Obligations

Extraterritorial
Yes
Breach notification
Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
DPO
No
Cross-border transfers
None
Maximum penalty
Fines up to RON 100,000 or 5% turnover for large companies; GDPR fines

§3Dates

Key dates
  • Adopted
  • In force
  • Amended 2012 for ePrivacy 2009 (cookies Art 4(5); marketing Art 12)

§4Text and authority

Text
Authority
ANSPDCP (cookies/marketing); ANCOM (telecom)

§5Where it applies

Domestic law of
Romania

§6Sources and verification

Sources consulted
Verification

Low confidence.

Partly verifiedLow confidence. Not verified this session.