Fine 15,000 Lei for Violation of Law 506/2004 (Cookies)
Summary
Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP) issued a fine of 15,000 Lei against a controller for violating Law 506/2004, Romania's national transposition of the EU ePrivacy Directive, specifically concerning cookie usage requirements. The enforcement action was published on 11 September 2025 and represents an active penalty for non-compliance with electronic communications data protection obligations.
Organisations with Romanian-facing websites or online services should audit their cookie consent workflows against Law 506/2004 requirements: consent must be freely given, specific, informed, and unambiguous; pre-ticked boxes are not permitted; users must be able to withdraw consent as easily as they gave it. The 15,000 Lei fine — approximately €3,000 at current exchange rates — represents a moderate sanction for a first enforcement action on cookies, suggesting the ANSPDCP calibrates penalties to the nature and scale of the violation rather than applying a fixed schedule.
What changed
The ANSPDCP imposed a monetary fine of 15,000 Lei on a data controller for violations of Law 506/2004, Romania's law implementing the EU ePrivacy Directive (2002/58/EC) as regards the processing of personal data and the protection of privacy in electronic communications. The specific conduct constituting the violation is not detailed in the announcement.\n\nOrganisations operating websites, apps, or online services that target Romanian users should ensure their cookie consent mechanisms, cookie banners, and privacy notices meet the requirements of Law 506/2004. The fine amount signals that the ANSPDCP applies meaningful financial penalties for cookie non-compliance, even for first-time enforcement actions of this nature. Controllers should review whether they have lawful bases for cookie placement and whether user consent — where required — meets the standards applied by the Romanian authority.
Archived snapshot
Apr 20, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
The National Supervisory Authority For Personal Data Processing
Mentioned entities
Related changes
Get daily alerts for Romania ANSPDCP
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ANSPDCP.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Romania ANSPDCP publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.