Cookie banners and GDPR in Romania — what the law requires

A cookie banner is one of the few compliance elements anyone can check from outside, and ANSPDCP does. In 2025 it fined the owner of a personal website for cookies set without consent, and the court upheld the fine. This article sets out the Romanian rule, the consent standard, the mistakes that are fined, and a checklist to run on your own site.

The legal framework

Two instruments work together:

• The ePrivacy Directive (2002/58/EC) — in Romania, Law no. 506/2004

  Article 4(5) of Law no. 506/2004 makes storing information on a user’s device, or reading information already stored there, conditional on prior consent after clear and complete information. Cookies are the usual case; pixels, local storage and device fingerprinting fall under the same rule.

• The GDPR (Regulation (EU) 2016/679)

  Defines what valid consent is (Articles 4(11) and 7): freely given, specific, informed and unambiguous, expressed by a clear affirmative action, and as easy to withdraw as to give. A cookie banner has to meet all of these at once.

Cookies strictly necessary for a service the user has asked for — session, authentication, shopping cart, security — do not need consent. Every other category — analytics, advertising, retargeting, social media plugins, embedded video — needs prior consent.

Two points matter for foreign-owned companies. First, the cookie rule is national ePrivacy law, so the GDPR one-stop shop does not apply: ANSPDCP can act against a site aimed at Romanian users whatever the group’s lead authority. Second, consent has to be informed. A site addressed to users in Romania should present the banner and the cookie policy in Romanian.

The five mistakes that lead to fines

1. 1
   Pre-ticked boxes

   In Planet49 (C-673/17, 2019) the Court of Justice held that a pre-ticked box is not valid consent. The user has to act. A banner with non-essential categories ticked by default is non-compliant.

2. 2
   Cookie walls

   Blocking the content of the site until the user accepts all cookies. The EDPB guidelines on consent (05/2020) state that consent obtained this way is not freely given.

3. 3
   Unequal choices

   A large, coloured “Accept all” button next to a small grey “Reject”, or a refusal hidden behind “Settings”. Refusing has to be as easy as accepting, at the same level of the banner.

4. 4
   Cookies set before consent

   The banner is displayed, but Google Analytics, the Meta Pixel or other tags have already loaded. This is the most serious technical failure, and the easiest to establish: the browser’s developer tools show it in seconds.

5. 5
   Vague descriptions

   Wording such as “we use cookies to improve your experience” is not enough. The user has to be able to find out which cookies are set, by whom, for what purpose and for how long — in the banner or in a cookie policy linked from it.

What a compliant banner contains

• Clear information on the categories used (necessary, functional, analytics, advertising)
• Granular choice: the user can accept by category, not only all or nothing
• “Accept all” and “Reject all” equally visible, of comparable size and colour
• A visible link to a cookie policy listing each cookie with its purpose, duration and provider
• No “scrolling means consent”: continuing to browse is not consent
• Non-essential cookies blocked until the user chooses — technically verifiable
• A way to withdraw consent later that is as easy as giving it, such as a persistent “Cookie settings” link
• Consent renewed at reasonable intervals and whenever purposes or partners change

Consent management platforms

Widely used options in Europe:

No platform is compliant by default. The configuration decides: which categories exist, whether tags are actually blocked before consent, and how the refuse option is displayed. Group-wide configurations set for another market often need adjusting for Romania — language, categories and the tags the local site actually loads.

Enforcement

In Romania, the reference case is Calin Georgescu (2025). ANSPDCP found that his website had set cookies between December 2024 and April 2025 without prior information and consent, and imposed a fine of 30,000 lei under Article 4(5) of Law no. 506/2004. A separate GDPR fine concerned the contact form, which did not say how the data would be used. The Ilfov Tribunal rejected the challenge in February 2026.

Elsewhere in the EU, the French authority, CNIL, has imposed the largest cookie fines:

• Google LLC and Google Ireland — 150 million EUR in total (December 2021): refusing cookies took more steps than accepting them
• Facebook (Meta Platforms Ireland) — 60 million EUR (December 2021): the same failure
• Microsoft Ireland — 60 million EUR (December 2022): cookies set on bing.com without consent, and no equally simple refusal
• TikTok — 5 million EUR (December 2022): refusing was harder than accepting

All four were imposed under French ePrivacy law, on companies whose GDPR lead authority was in Ireland — the same mechanism that lets ANSPDCP act on sites aimed at Romanian users. For the wider picture of ANSPDCP fines, see GDPR fines in Romania — real cases.

Checklist: seven points on your site

1. 1

   The banner appears on the first visit, before any non-essential cookie is set

2. 2

   “Accept all” and “Reject all” are equally visible (size and colour comparable)

3. 3

   Granular settings are reachable in one click

4. 4

   Non-essential cookies are not set until the user consents (check in the browser’s developer tools)

5. 5

   The cookie policy is easy to reach and lists each cookie with its purpose and duration

6. 6

   Consent can be withdrawn at any time through a persistent link or button

7. 7

   The banner and the policy are available in Romanian for Romanian users

The website side of compliance — banner, cookie policy, privacy notice and forms — is covered in detail on website and cookie compliance.

Frequently asked questions