Is cold email legal in Romania? B2B rules for 2026
2026-10-25 · updated 2026-10-25 · 8 min read · Adam Axelsson, founder of Revexa
No, not without prior consent. Article 12 of Romania's Law No. 506/2004 bans commercial email unless the subscriber or user has given prior express consent, and paragraph (4) applies the ban to subscribers that are legal persons, so a company's info@ address is covered too. Named employees and sole traders (PFA) need consent as well, and the e-commerce law (Law No. 365/2002, art. 6) repeats the rule for email. The only exception is a narrow soft opt-in for your own customers.
Checked on 25 October 2026 against the law texts and the regulator's reports and press releases. This is not legal advice.
Romania sits with Poland, Italy and Germany: consent first, even in B2B. All countries: cold email laws by country.
Romania at a glance
| Situation | Rule | Source |
|---|---|---|
| Generic company address (info@) | Prior express consent | Law 506/2004 art. 12(1) and (4); Law 365/2002 art. 6(1) |
| Named employee | Prior express consent | art. 12(1) ("subscriber or user") |
| Sole trader (PFA) | Prior express consent | art. 12(1) |
| Existing customers (soft opt-in) | Allowed, narrow: address obtained in a sale, your own similar products, an opt-out at collection and in every message | art. 12(2) |
| LinkedIn messages | No guidance (our reading: covered); ANSPDCP fined LinkedIn marketing after an objection (GDPR, 2023) | art. 12(1); ANSPDCP |
| Regulator | ANSPDCP; for Law 365/2002 also the Romanian Digitalization Authority (ADR) | art. 13(5); Law 365/2002 art. 23(1) |
| Maximum fine | 5,000 to 100,000 lei, or up to 2% of turnover for companies with turnover above 5,000,000 lei; GDPR up to €20 million or 4% of worldwide turnover | art. 13(2); GDPR art. 83(5) |
What the law says
The ePrivacy Directive requires consent for marketing email only for "subscribers who are natural persons" and leaves other subscribers to each member state (Article 13(5)). Romania chose consent for both. Article 12 of Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, in the consolidated text on legislatie.just.ro (latest consolidation 8 October 2024):
"(1) Este interzisă efectuarea de comunicări comerciale prin utilizarea unor sisteme automate de apelare și comunicare care nu necesită intervenția unui operator uman, prin fax ori prin poștă electronică sau prin orice altă metodă care folosește serviciile de comunicații electronice destinate publicului, cu excepția cazului în care abonatul sau utilizatorul vizat și-a exprimat în prealabil consimțământul expres pentru a primi asemenea comunicări."
"(4) Prevederile alin. (1) și (3) se aplică în mod corespunzător și abonaților persoane juridice."
Our translation: "(1) It is prohibited to make commercial communications using automated calling and communication systems that do not require a human operator, by fax or by electronic mail, or by any other method that uses electronic communications services available to the public, unless the subscriber or user concerned has given prior express consent to receive such communications." and "(4) Paragraphs (1) and (3) also apply, accordingly, to subscribers that are legal persons."
Paragraph (1) has its wording from Emergency Ordinance No. 13/2012; in our reading of the consolidation history, nothing since has changed article 12. Paragraph (2) is the soft opt-in: an address obtained directly from a customer "on the occasion of the sale" may be used for your own similar products, with a simple, free way to object at collection and in every message. Paragraph (3) bans email that hides the sender or lacks a valid stop address.
Law No. 365/2002 on electronic commerce adds a second consent rule for email (art. 6(1)), protecting any "destinatar", defined as "orice persoană fizică sau juridică" (any natural or legal person) using an information society service (art. 1(6)). A commercial communication is anything meant to promote, directly or indirectly, a trader's products, services, image or name (art. 1(8)).
What the regulator says
ANSPDCP, the National Supervisory Authority for Personal Data Processing, enforces article 12 (art. 13(5)). We found no stand-alone B2B guidance, but its reports and press releases agree:
- Express, not presumed. Its 2019 activity report (pp. 29 and 30) says commercial email needs "consimţământul expres (nu prezumat)" (express, not presumed, consent), and that the soft opt-in covers an address obtained in a sale, "iar nu cu ocazia negocierii/încheierii unui contract" (not while negotiating or concluding a contract).
- Only on express prior consent. In a case published on 26 November 2025, it ordered a company to send electronic marketing "numai în baza consimțământului expres prealabil al persoanelor vizate" (only on the data subjects' express prior consent) (Cucina di Fabio S.R.L.).
ANSPDCP quotes paragraph (4) in its own releases (BNP Paribas Personal Finance, 2021). One caveat: in 2012 it did not admit complaints from petitioners who "aveau calitatea de persoane juridice" (were legal persons) (2012 report, p. 37). In our reading, that concerns who could complain, not what the law allows.
Named employees, sole traders and the first email
Article 12 protects both. A subscriber is any natural or legal person, or economic enterprise without legal personality, with a contract for electronic communications services (Emergency Ordinance 111/2011, art. 4(1) point 3); a user is a natural person using the service (Law 506/2004, art. 2(1)(a)). So a named work address needs consent like info@; we found no guidance on whose consent counts, the employer's or the employee's.
A sole trader (PFA, persoană fizică autorizată) is an economic enterprise without legal personality, organised by a natural person (Emergency Ordinance 44/2008, art. 2(i)), so it fits the subscriber definition and consent applies too.
Can a first email ask for consent? We found no Romanian decision. Since a commercial communication includes anything promoting a trader's name or image, and consent cannot be presumed, a "may we send you an offer?" email is risky (our reading).
LinkedIn and social media messages
No guidance found from ANSPDCP or a court. Article 12(1) reaches "any other method" using public electronic communications services, which since Law No. 198/2022 include interpersonal communications services, unless messaging is only a minor ancillary feature of another service. Whether that describes LinkedIn is undecided. Our reading: treat a LinkedIn sales message to someone in Romania like an email.
GDPR applies either way. In a release of 18 September 2023, ANSPDCP said it had fined NN Asigurări de Viață S.A. 4,946.50 lei (1,000 euro) under GDPR art. 21(3) for sending "mesaje în scop de marketing, prin mesageria Linkedin" after the person had objected (ANSPDCP). The release does not say whether they concerned the person's work.
GDPR and ANSPDCP
- Legitimate interest. Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest" (GDPR). In Romania that can cover the data, not the sending: Law 506/2004 requires express consent for email. More in GDPR and B2B email under legitimate interest.
- Article 14. Data from public sources means telling the person, source included, within one month of getting the data and at the latest in the first message (art. 14(2)(f) and 14(3)(a) and (b)); a missing source was one of the breaches ANSPDCP found in the ISRA case below.
- Objection. After an objection, "the personal data shall no longer be processed for such purposes" (art. 21(3)). Many of the marketing fines we found concern messages sent after one.
Fines and real cases
Breaching article 12 is fined at 5,000 to 100,000 lei, or up to 2% of turnover for companies with turnover above 5,000,000 lei (art. 13(1)(q) and (2)). Law 365/2002 adds 1,000 to 100,000 lei (art. 22(a)). In 2025, ANSPDCP imposed 9 fines under Law 506/2004 totalling 187,000 lei (2025 report, p. 70). By our count, every Law 506 fine in its 2025 press releases concerned cookies; Money Seeds (below), investigated in 2025, was published in January 2026.
From ANSPDCP's press releases, newest first; in our reading, none is clearly B2B:
| Company | Published | What happened | Fine | B2B or B2C |
|---|---|---|---|---|
| AMATO BESTSELLER S.R.L. | 6 Aug 2026 | Automated calls without express prior consent | 50,000 lei (art. 12(1)), plus GDPR fines | B2C (our reading: health and family data) |
| Money Seeds S.R.L. | 8 Jan 2026 | Emails after an objection, no simple, free way to object | 5,000 lei (art. 12), plus 10,178 lei (2,000 euro) under GDPR | Not stated |
| NN Asigurări de Viață S.A. | 18 Sep 2023 | LinkedIn marketing after an objection | 4,946.50 lei (1,000 euro), GDPR | Not stated |
| ISRA Center Marketing Research SRL | 7 Sep 2023 | Name, email and workplace taken from public sources; source not given, objection ignored | Two fines, 9,898 lei (2,000 euro) in total, GDPR | Closest to B2B (our reading); a research invitation, not a sales offer |
Checklist for B2B email to Romania
- Get express prior consent before the first commercial email, for info@, named employees and PFAs alike, and keep proof.
- Do not treat a published address or a bought list as consent.
- Use the soft opt-in only for real customers and your own similar products.
- Avoid "may we send you offers?" emails.
- Name your company, give a working stop address and say where you got the data (GDPR art. 14).
- Honour every objection in every channel, LinkedIn included, through a suppression list.
How Leo handles Romania
Leo, the buying-signal agent Revexa builds, blocks only Germany automatically, not Romania. Romanian law requires express prior consent even for company addresses, and in review mode, the default, you read and approve every draft, so whether a Romanian lead has consented is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Romanian consent for you.
More countries: Czech Republic, Estonia, Greece and Hungary.
Common questions
Is B2B cold email legal in Romania?
No, not without consent. Article 12 of Law No. 506/2004 requires express prior consent for commercial email, and paragraph (4) applies it to companies. Only existing customers can be emailed under a narrow soft opt-in.
Can I email a Romanian company's info@ address without consent?
No. Article 12(4) extends the consent rule to subscribers that are legal persons, and the e-commerce law protects any natural or legal person. In our reading, a published address is not express consent.
Can I send LinkedIn sales messages to Romanian prospects?
In our reading, treat them like email. Article 12 covers "any other method" using public electronic communications services. We found no ruling on whether that includes LinkedIn, but ANSPDCP fined an insurer under GDPR in 2023 for LinkedIn marketing sent after an objection.
What are the fines for cold email in Romania?
5,000 to 100,000 lei for a breach of article 12, or up to 2% of turnover for companies with turnover above 5,000,000 lei, plus GDPR fines. The article 12 fines we found since 2019 range from 5,000 to 50,000 lei.