EAGLE SOLUTIONS
In short: On 84% of the homepages of 81 Harghita company websites there is no CUI or Trade Register number, and on 52% it is missing from the whole site. On 49% tracking cookies start before consent, 13 sites still run Universal Analytics, and 9 of 12 online stores still link to the closed ODR platform.
At most companies, website legal compliance is nobody's job. In the second part of the series in which I measured the websites of 100 companies in Harghita County, I checked whether the 81 working company websites have the basic elements Romanian law requires: the company ID, the privacy policy, cookie consent and, for online stores, the ANPC links.
This is not legal advice. As a developer I measured what can be checked automatically, and I refer to the text of the laws. What exactly applies to your business is something a lawyer can tell you.
How I measured
The measurement was taken on 27 September 2026. The sample: the 50 largest companies in Harghita County from the Termene 2025 revenue ranking, and 50 small businesses from different sectors. Of the 100 companies, 87 have a website and 81 of those showed content; the numbers below refer to these 81 websites. I checked each homepage in mobile view with my own Playwright-based script and read the cookies four seconds after loading, without any click.
Limits: the small-business half contains only companies with a working website. I looked for the company ID on the homepage and on up to 8 contact, about or legal subpages. I recognised a cookie banner by known consent management plugins and by a fixed bar on screen that talks about cookies. The online store sample is small, 12 stores.
Company ID: missing from 84% of homepages and 52% of websites
Under Article 5 of Law 365/2002 on electronic commerce, anyone offering services through a website must give easy and permanent access to the company name, registered office, contact details, Trade Register number and tax ID (CUI). The law does not require these to be on the homepage, so I measured two numbers:
- On the homepage, 68 of 81 websites (84%) show neither a CUI nor a Trade Register number. A CUI appears on only 11 homepages (14%).
- Checking the contact, about and legal subpages as well, things improve, but 42 of 81 websites (52%) still show no company ID anywhere.
The large companies are no better here: 55% for them, 50% for small businesses. The fix is one line in the footer, which appears on every page. My checklist lists exactly what it should contain.
Privacy policy: 40% have no link on the homepage
32 of 81 websites (40%) have no link to a privacy policy on the homepage. Some of them may have one deeper in the site, but under the GDPR the information must be easily accessible, and a footer link is the usual way to do it. Where the site has a contact form or a tracking code, the link has to be there.
Tracking cookies before consent: on every second website
Under Law 506/2004, cookies that are not strictly necessary may only be used with the visitor's prior consent. The measurement shows:
- On 40 of 81 websites (49%) at least one tracking cookie is set before the visitor clicks anything.
- The most common is the Google Analytics
_gacookie (34 websites), followed by the Facebook pixel_fbpcookie (14), the Google Ads_gcl_aucookie (7) and Hotjar (2). - On 34 websites (42%) I found no cookie banner.
- The two numbers together say the most: 26 websites have a cookie banner, yet tracking still starts before consent. On those sites the banner blocks nothing.
- On 14 websites (17%) tracking runs with no banner at all.
A working cookie banner starts no tracking code when the page loads, only after "Accept". Anyone can check this in a private browser window: if a cookie starting with _ga appears before you accept anything, tracking runs without consent.
A dead tracking code that still sets cookies
One finding stands out: on 13 websites (16%) Universal Analytics cookies appeared (__utm… or _gat_UA-…). This is the old Google measurement tool: Google stopped processing its data in July 2023 and shut it down for good in July 2024. These websites therefore run a dead tracking code that no longer collects any data for the owner, yet still sets cookies on the visitor's device without consent. Four of the 13 have no cookie banner either.
This is the easiest fix of all: remove the old code. The website loses nothing, since it no longer measures anything anyway.
Online stores: SAL and ODR
I checked the 12 online stores in the sample separately, by their links and icons. The sample is small, so the result is only indicative:
- 10 stores have the ANPC alternative dispute resolution (SAL) link. 2 stores have no ANPC link at all.
- 9 of 12 stores still link to the EU online dispute resolution platform (ODR/SOL). The platform closed on 20 July 2025, so the link points to a service that no longer exists.
ANPC changed the rule in May 2026: the SOL icon is no longer needed, and the new SAL icon links to reclamatiisal.anpc.ro. I wrote about the mandatory elements of online stores and this change here.
Website legal compliance: a five-minute self-check
- Does your footer show the company name, registered office, Trade Register number and CUI?
- Is there a privacy policy link in the footer?
- In a private window, without accepting, does a
_ga,_fbpor_gcl_aucookie appear? If so, your cookie banner blocks nothing. - Is there a
__utmor_gat_UAcookie? Then a discontinued tracking code is running and should be removed. - For online stores: is the ODR/SOL link still there? And does the SAL link point to reclamatiisal.anpc.ro?
If you do not know the answer to one of these, send me your website address and I will check it with the same measurements. On every website I build these are in order from the start, and in a website takeover they are part of the first check.
