Legal checklist for a website or online shop in Romania (2026)

A business website or online shop in Romania must show who the seller is, its terms, privacy and cookie policies, the ANPC SAL pictogram and, since 19 June 2026, an online withdrawal function. Here is the 2026 checklist, with the official sources.

Important: this article gives general information, valid at the time of writing (October 2026), and is not legal advice. The rules change often and depend on your business, so check the official texts and, for your specific case, talk to a lawyer or consultant.

1. Who the seller is (Law 365/2002)

Romania's e-commerce law requires visitors to find your company details easily and at all times. Put them on a dedicated page (for example "Legal information") and in the site footer:

• the company name and legal form (SRL, PFA and so on);
• the registered office;
• contact details, including an e-mail address you actually answer;
• the Trade Register number and tax code (CUI), plus your VAT number if you have one;
• any authorisations, if your activity needs them.

2. Terms and conditions

Your terms describe how the contract is made: how orders are placed, price and payment, delivery or activation, guarantees, complaints and the withdrawal right. Write them for your business; don't copy another site's: text about "courier delivery" on a site that sells digital services will trip you up at the first inspection. For an example of the structure, see our terms.

The final order button must make it clear that pressing it means you'll have to pay, for example "Order with obligation to pay" (in Romanian, „Comandă cu obligație de plată”). A plain "Continue" is not enough.

3. Privacy policy (GDPR)

If your site collects personal data (contact form, customer account, orders, newsletter), you must inform people as required by Article 13 GDPR:

• who the controller is and how to contact them;
• what data you collect, for what purpose and on what legal basis;
• who you share it with (courier, payment processor, accountant, hosting provider);
• how long you keep it;
• what rights people have, and that they can complain to ANSPDCP, the Romanian data protection authority.

Collect only what you need, and use HTTPS on every page with a form.

4. Cookies (Law 506/2004)

Law 506/2004 requires the visitor's consent before storing or reading information on their device, with one exception: cookies that are strictly necessary for the site to work (shopping cart, login session, security) need no consent, only information.

• If you only use strictly necessary cookies, a clear cookie policy and an informational notice are enough.
• If you add analytics, ad pixels, chat widgets or embedded videos that set cookies, you need a real consent banner: nothing loads before "Accept", and refusing is as easy as accepting.
• Describe each cookie in your cookie policy: name, purpose, lifetime, who sets it.

ANSPDCP has already fined companies for setting non-essential cookies without consent. At the time of writing, Parliament is discussing a proposal to change the rules for consent banners, so keep an eye on the news.

5. The ANPC SAL pictogram

Traders selling online to consumers must display information about Alternative Dispute Resolution (SAL in Romanian), under ANPC Order 449/2022 as amended in 2026 by ANPC Order 270/2026. In short, at the time of writing:

• display the official SAL pictogram (250 × 50 px), downloaded from anpc.ro, in a visible place (usually the home page or the footer);
• the pictogram links to the ANPC platform reclamatiisal.anpc.ro;
• the link to the EU ODR (SOL) platform is no longer needed: the platform closed on 20 July 2025 under Regulation (EU) 2024/3228. If you still have it on your site or in your terms, remove it.

Check the exact form and placement on the ANPC website, because some sectors (financial services, for example) have their own rules.

6. Withdrawal right and the online withdrawal function

A consumer buying at a distance generally has 14 days to withdraw from the contract without giving a reason (Emergency Ordinance OUG 34/2014). There are exceptions, for example services fully performed with the consumer's express consent, or digital content supplied immediately, but you must inform the consumer properly before the order and get their explicit consent.

What's new in 2026: OUG 18/2026, which transposes Directive (EU) 2023/2673, added to OUG 34/2014 the requirement for an online withdrawal function, applicable from 19 June 2026 to contracts concluded through an online interface. In short:

1. a visible, clearly labelled function (for example „Retrageți-vă din contract aici”, "withdraw from contract here"), available for the whole withdrawal period;
2. the consumer enters only what's needed: their name, details identifying the contract (such as the order number) and the address where they want the confirmation;
3. the request is sent through a second, clearly labelled button (for example „Confirmați retragerea”, "confirm withdrawal");
4. you promptly send an acknowledgement on a durable medium (usually e-mail), with the content of the statement and its date and time.

A PDF form in the footer is no longer enough. For an example implementation, see our contract withdrawal page.

7. Prices including VAT

Show consumers the final price, with all taxes included, VAT among them, plus delivery or any other extra costs, before they order. If you also sell to businesses you can show the price without VAT as well, but a private buyer must clearly see the total they will pay.

8. e-Factura

Invoices issued by companies established in Romania go through the RO e-Factura system, and since 1 January 2025 this also applies to invoices issued to private individuals (B2C), under OUG 120/2021. Private customers don't have to do anything in the ANAF online portal (SPV); the obligation is the issuer's. Check that your invoicing platform sends invoices to the system automatically.

Quick checklist

In short

Identify yourself clearly, explain your order rules and how you use data, ask for consent only for cookies that aren't strictly necessary, show the SAL pictogram linking to the ANPC platform, offer the online withdrawal function and show prices including VAT. Then check the official sources regularly, because the rules change.