May 2026 – Romania is taking a significant step towards bringing its cookie consent rules into line with the standards established under the General Data Protection Regulation (GDPR) and the guidance of the European Data Protection Board (EDPB). A legislative proposal currently under parliamentary review would introduce binding, prescriptive requirements governing the design and operation of cookie consent mechanisms – requirements that will have direct practical consequences for any organisation operating a website or digital service accessible from Romania.
The domestic legal framework on cookies is primarily governed by Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, which transposes Directive 2002/58/EC into Romanian law. The law already establishes the requirement to obtain user consent prior to storing or accessing information on a user’s terminal equipment. However, it has not been substantively updated
