What Romanian law requires on a company website

Romania's Companies Law, Law 31/1990, requires at article 74 that documents used in commerce carry the company's name, legal form, registered office, trade register number and tax ID. The same obligation covers the company's website.

In practice this means one line in the site's footer: the company's full name, its legal form, the registered office address, the trade register number and the tax ID. Joint-stock companies also show their share capital.

A thing learned along the way: the data comes from the public ANAF registry, not from memory or a message. On one of our sites, the check showed the company was not VAT registered, so displaying a VAT number would have suggested a VAT registration that did not exist.

If the site has a contact form, it collects personal data: name, email, phone. From that moment the GDPR applies, Regulation (EU) 2016/679, implemented in Romania through Law 190/2018.

The mandatory minimum: a privacy policy that says what data you collect, why, how long you keep it and what rights the visitor has. Written for your site, not copied from another site complete with the other company's name, which we have seen more often than we would like.

Law 506/2004 on data processing in electronic communications requires consent before placing cookies that are not strictly necessary, such as analytics or marketing cookies.

Beware the decorative banner: a banner that merely announces cookies while the tracking cookies load anyway is not consent. A site that uses only strictly necessary cookies can legally run without a banner at all.

Businesses selling to consumers display the link to ANPC, the national consumer-protection authority, and to the alternative dispute resolution platform, SAL.

A current trap: the European ODR platform, which many Romanian sites still link in their footer, was shut down in July 2025. A dead ODR link no longer covers anything; the site's legal text needs bringing up to date.

Selling online adds the e-commerce obligations of Law 365/2002 and, for consumers, the 14-day right of withdrawal from Government Ordinance 34/2014, with no reason required.

Concretely: real terms and conditions, the total price shown before the order, an order confirmation, and a returns procedure described on the site, not improvised at the first angry phone call.

Since Ordinance 58/2022, the Romanian transposition of the EU Omnibus directive, a site that publishes reviews must say whether and how it checks that they come from real customers. Invented testimonials were already misleading advertising; now displaying reviews without explaining the checks is punishable too.

On our sites, reviews do not publish themselves: they arrive by email first and are read, and each one shows whether the author was a client. The section explains openly how the checking works.

We are a web firm, not a law office, and this article is a starting point, not legal advice. What we commit to is our side: every site we build sets off with the list above ticked, with the company's details taken from the ANAF registry and the policies written for that specific site.