02What Romanian law says
Romania applies the rule through Law 506/2004. Article 4(5) allows storing or reading information on a user's device only if two conditions are met together: the user has given consent, and before consenting was given clear and complete information in easy language, including the purpose of the processing. Article 4(6) says paragraph 5 does not stop technical storage or access used only to carry out a transmission over an electronic communications network, or strictly necessary for an information society service the user explicitly requested. ANSPDCP enforces the rule. In a press release dated 14 October 2025 (dataprotection.ro/?page=Comunicat_Presa_14.10.2025), it said it had closed an investigation in September 2025 and fined the travel agency Coral Travel 5,000 lei under Article 4(5)(a) of Law 506/2004 for storing non-necessary cookies without consent. It ordered a clear banner and that no non-necessary cookies be placed before valid consent. A law firm note dated 27 April 2026 describes amendments still under review in Parliament, so check the current consolidated text on legislatie.just.ro.
- Law 506/2004, Article 4(5): consent plus clear, complete prior information, both required
- Article 4(6): paragraph 5 does not stop technical storage strictly necessary for a service the user explicitly requested
- ANSPDCP fined a travel agency 5,000 lei for non-necessary cookies set without consent (release of 14 October 2025)
- A draft amendment was reported as pending in Parliament in April 2026: check the current text
03What usually needs consent, and what may not
Analytics and advertising cookies serve the site owner, not the service the visitor asked for, so on the plain reading of the law's wording they sit on the consent side. ANSPDCP's own cookie page says its embedded YouTube video may install session or persistent cookies when a visitor asks to play it, which shows how an ordinary embed can bring cookies along. On the other side are things that serve what the visitor asked for, such as a session that keeps a login or a cart. The law's wording is 'strictly necessary', and the EDPB says exemptions are assessed case by case with national authority guidance in mind. Where a given cookie falls depends on the facts, so ask a legal adviser or a data protection officer. A banner is also only one duty. If your contact form collects names and emails, GDPR Article 13 still requires you to say who you are, why you collect the data, who receives it and how long you keep it. That is what a privacy page is for.
- Analytics and advertising cookies serve the site owner, so they sit on the consent side
- Embedded video can bring cookies: ANSPDCP's own cookie page says so about its YouTube embed
- A login session or a cart serves what the visitor asked for
- A contact form still needs a privacy notice under GDPR Article 13
04What proof48.com does, and what we do not claim for your site
Our own site shows a banner because it runs Google Analytics 4. The code sets Google's consent defaults to denied, stores the visitor's choice in the browser, offers Reject and Accept side by side, and keeps analytics storage denied until the visitor accepts. Our privacy page lists the other tools on the site and the one language cookie. Do not read that as a template for yours. The code of proof48.com tells you nothing about a different site, and we do not claim any default banner or cookie setup for the sites we build, apart from what a case study states: the SunVolt Club build wired cookie consent into analytics before any tag fires. What a site needs depends on the scripts, embeds and tools that run on it.
- proof48.com shows a banner because it runs Google Analytics 4, denied until the visitor accepts
- Our privacy page lists the other tools and the one language cookie
- We claim no default banner for client builds
- List every script, embed and tool on your site before you decide
05Where PROOF48 is the wrong choice
PROOF48 is a website builder, not a law firm or a consent-management vendor. We can build a business website of up to about five pages in 48 hours for 500 to 2,500 EUR, paid after you see the preview, but what your cookie wording and privacy notice must say is for you and your legal adviser to confirm. We are the wrong choice if you need a lawyer's sign-off on that wording before a word ships: our own page on the build-first offer says projects needing legal or medical review before a word ships do not fit it. Sites in more than two languages, and stores, get their own timeline. Ad tracking is a separate conversation. The Pixel and GA4 conversion tracking inside GROWTH (1,497 EUR a month) are browser tracking tools of the kind the EDPB guidelines address, so a consent setup belongs in that discussion.
- A 48-hour website: up to about five pages, 500 to 2,500 EUR, paid after the preview
- Cookie wording and privacy notices are for you and a legal adviser to confirm
- Wrong choice if you need a lawyer's sign-off before launch
- Pixel and GA4 tracking in GROWTH is a separate consent conversation
A build where consent came before the tags
In the SunVolt Club build for SunVolt Energy UAB, cookie consent was wired into analytics before any tag fires. The platform sells an annual membership in Romanian and English with Stripe checkout. That is one case with one company's tools, so it tells you what we have done, not what your site needs. We do not publish SunVolt's member numbers or any consent-rate figure, because we do not measure them.
See the build: SunVolt ClubQuestions, answered
Do I need a cookie banner if I only use Google Analytics?
Google Analytics sets cookies that are not strictly necessary for the service a visitor asked for, so under the EU and Romanian rules the usual approach is consent before analytics storage is allowed. Our own site keeps analytics storage denied until the visitor accepts. Confirm your case with a legal adviser.
Is a banner enough on its own?
No. Law 506/2004 requires consent plus clear prior information. In a decision announced on 14 October 2025, ANSPDCP required that non-necessary cookies not be placed before valid consent is obtained.
Does a site with no cookies need a banner?
Not necessarily, but check what else runs. The EDPB says Article 5(3) covers more than cookies, including tracking pixels and scripts that make the browser send data back. If nothing non-essential is stored or read on the device, there is nothing to ask consent for.
Do I still need a privacy page without a banner?
If you collect personal data, such as names and emails through a contact form, GDPR Article 13 requires you to tell people who you are, why you collect it, who receives it and how long you keep it. That is separate from the cookie rule.
Does PROOF48 add a cookie banner to every site it builds?
We do not publish a default for client builds, so we claim nothing either way. proof48.com has a banner because it runs Google Analytics 4. Ask what scripts will run on your site before launch.
Where PROOF48 fits
A site needs a cookie banner when it stores or reads anything non-essential on the visitor's device, from analytics cookies to tracking pixels. A site that sets only strictly necessary cookies, or nothing, may not. List every script and embed on your site, ask a legal adviser about the non-essential ones, and read Law 506/2004 Article 4 yourself. PROOF48 builds the 48-hour website for 500 to 2,500 EUR, and the legal wording is yours to confirm.
Cosmin Tiu · Founder, PROOF48
Cosmin has worked in online marketing and software development since 2018, and has built with AI every day since January 2023. He still writes code from scratch daily, in Python, React, Rust and C#. PROOF48 ships business websites in 48 hours and invoices afterwards, so every opinion on this blog was paid for in real builds, not in theory.