Selling online in Romania: what 100 Transylvanian online shops get wrong on consumer law

If you are selling online in Romania from abroad, the rules look familiar at first: EU consumer law, a 14-day right of withdrawal, GDPR. The Romanian specifics are in the details: an ANPC link in the footer that changed in May 2026, company identifiers most foreign sellers have never heard of, and a cookie law that is enforced. To see how local shops handle them, on 27 September 2026 I checked 100 working online shops in Transylvania: 45 in Harghita, 18 in Mureș and 15 in Covasna County, and 22 in other Transylvanian counties. 72 of them sell in Hungarian or bilingually, 28 only in Romanian.

In my legal compliance study of company websites in Harghita only 12 online shops ended up in the sample, so this time I looked at shops only. I do not name any shop, only aggregate numbers.

This is not legal advice. As a developer I measured what can be checked automatically from the outside, and I refer to the text of the laws. What exactly applies to your store, and whether your terms are right, is something a lawyer can tell you.

The key numbers

• 61 shops still link to the EU online dispute resolution (ODR) platform, which closed on 20 July 2025.
• 29 shops have no ANPC SAL link, although it is mandatory. 6 of them have no SAL link but still show the ODR link.
• On 52 shops at least one tracking cookie is set before the visitor clicks anything in the cookie banner.
• Company identification is incomplete on 41: on 37 I found no Trade Register number, on 16 no tax ID either.
• As upper estimates: on 13 I found no link to the terms and conditions, on 24 no privacy policy link, on 25 no 14-day withdrawal notice.
• I found all 7 core elements (tax ID, Trade Register number, terms, privacy policy, 14-day withdrawal notice, model withdrawal form, SAL link) on 8 shops.

How I measured

I collected the sample through web searches and checked every shop with curl as well: only working small-business online shops with prices and a cart made it in. National chains and marketplaces were left out. The measurement was done by my own Playwright-based script, using desktop Chromium with Romanian language settings. For each shop it opened at most 6 public pages: the homepage, the terms, the privacy policy, the returns page, the contact page and one product. It did not add anything to the cart, place orders or create accounts. It read the cookies four seconds after loading, without any click. It recognised the ODR and SAL links by their address (href), not by their image.

I also checked ten randomly chosen shops by hand, with a method independent of the script. The first run revealed systematic errors (for example, because of text glued together the script missed a Trade Register number, and it read an email address followed by a postcode as a tax ID). I fixed these and re-measured all 100 shops. In the final run, for all ten shops the company identifiers, the terms and privacy links, the 14-day text and the SAL and ODR links matched the manual check.

The limits of the measurement:

• I opened at most 6 pages per shop. If a piece of information only appears on another page, the script sees it as missing. It only recognises the terms and the privacy policy by the usual link names. The missing rates are therefore upper estimates.
• Between two full runs, the tracking cookie result changed for 2 shops (timing, varying loading), so that number is accurate to ±2 points.
• The cookie banner is found by a heuristic. A banner shown in an iframe or in shadow DOM is not always detected.
• In the county breakdown the small groups (Covasna 15, Mureș 18 shops) should be read with care: one or two shops move the percentage a lot.

The ODR link: 61 shops point to a closed platform

Since 2022, two pictograms were mandatory in the footer of Romanian online shops: SAL (alternative dispute resolution, run by ANPC, the Romanian consumer protection authority) and SOL, the EU ODR platform. The European Commission closed the ODR platform on 20 July 2025. ANPC therefore amended Order 449/2022 with Order 270/2026, in force since 19 May 2026: the SOL/ODR pictogram and link are no longer required.

Of the 100 shops, 61 still link to ec.europa.eu/consumers/odr. This is not a breach of the law, but it is an outdated and misleading element: it sends customers to a platform that no longer works. The fix is to delete one link and one image from the footer.

If you sell in several EU countries, this is worth checking everywhere: the ODR link was an EU-wide requirement, so it may sit in the footer of your other country stores too.

ANPC SAL: 29 shops without a link

The SAL pictogram, on the other hand, is still mandatory. Its new version is 250×50 pixels and must link to reclamatiisal.anpc.ro. Of the 100 shops, 29 have no SAL link at all. I also counted the old anpc.ro/ce-este-sal address as a SAL link, so the 29 are the shops with neither. Whether the existing pictograms already use the new 250×50 format, I did not measure.

Together the two numbers show that the 2026 change has not reached most shops yet: of the old pair of pictograms, one stayed on for no reason, and the other is missing from many shops altogether. I wrote about the change and the mandatory elements of a Romanian online store here.

Tracking cookies before consent: 52 shops

Under Article 4 of Law 506/2004, cookies that are not strictly necessary may only be used with the visitor's prior consent. The results:

• On 52 shops (±2) at least one tracking cookie is set before the visitor clicks anything.
• The most common are Google Analytics _ga (37 shops), the Facebook pixel _fbp (30), Google Ads _gcl_au (13) and Hotjar (5).
• On 27 shops I found no cookie banner. Given the limits of the heuristic, this is a cautious number.
• Where the script did find a banner (73 shops), on 39 tracking still starts before consent. The banner only announces that there are cookies, without blocking anything.

In online shops this is especially common, because the Facebook pixel and the Google Ads conversion code are often added by a plugin or the platform's built-in integration, independently of the cookie manager. You can check in a private browser window: if a _ga or _fbp cookie appears without accepting, tracking runs without consent.

Company identification: incomplete on 41 shops

Article 5 of Law 365/2002 requires the company name, registered office, contact details, Trade Register number (the "J number", Reg. Com.) and tax ID (CUI) to be easily and permanently accessible. For a foreign company the equivalent registration details apply. On the pages I opened:

• on 37 shops I found no Trade Register number;
• on 16 no tax ID either;
• at least one of the two is missing on 41.

The fix is one line in the footer, visible on every page. My checklist lists what it needs to contain.

Terms, privacy, 14 days: what I did not find

Here "I did not find" is the accurate wording, because the script only looked for the usual link names and at most 6 pages:

• on 13 shops I did not find a terms and conditions link;
• on 24 I did not find a privacy policy link;
• on 25 I did not find the 14-day right of withdrawal notice on the pages I opened.

The last one is the most expensive gap. Under Emergency Ordinance 34/2014 (OUG 34/2014), which transposes the EU Consumer Rights Directive, if customers were not informed of their right of withdrawal, the 14-day period is extended by 12 months.

I did not measure the label of the order button, because it is not visible without adding something to the cart. The same ordinance requires the button that completes the order to state clearly that the order comes with an obligation to pay (in Romanian, for example, "Comandă cu obligație de plată"), so check it in your own checkout, in every language your store uses.

I also had measurements for the model withdrawal form, the "Reject" button in the cookie banner and the VAT notice on product pages, but automatic recognition is not reliable enough for these, so I do not publish numbers. This is also why the "all 7 elements" share is a strict one: for example, I did not count an online returns form embedded in the page as a model form.

By county and by language

Each line: the ODR link still present, no SAL link, tracking cookies before consent, and incomplete company identification.

• Harghita (45 shops): ODR 71%, no SAL 18%, tracking cookies 60%, incomplete identification 42%.
• Mureș (18 shops, small sample): ODR 39%, no SAL 39%, tracking cookies 44%, incomplete identification 39%.
• Covasna (15 shops, small sample): ODR on 9, no SAL on 7, tracking cookies on 8, incomplete identification on 6.
• Other Transylvanian counties (22 shops): ODR 59%, no SAL 32%, tracking cookies 41%, incomplete identification 41%.

Harghita has the most leftover ODR links, but it is also where the SAL link is missing least often.

By language, the differences point in opposite directions:

• Of the 28 Romanian-only shops, 13 (46%) have no SAL link, compared with 16 of 72 (22%) among the Hungarian or bilingual shops.
• Company identification, on the other hand, is incomplete on 6 of 28 (21%) Romanian-only shops and on 35 of 72 (49%) Hungarian or bilingual ones; the Trade Register number is missing on 5 of 28 (18%) and 32 of 72 (44%).
• The ODR link (61% in both groups) and tracking cookies (54% and 51%) are about the same.

I did not measure the reason, but it is a useful warning for any foreign seller: a legal page copied from your home market will miss the Romanian items.

Selling online in Romania: a ten-minute self-check

• Is there still an ODR/SOL pictogram or an ec.europa.eu/consumers/odr link in your footer? If so, remove it.
• Is there an ANPC SAL pictogram linking to reclamatiisal.anpc.ro?
• In a private window, without accepting, does a _ga, _fbp or _gcl_au cookie appear?
• Does the footer show the company name, registered office, Trade Register number and tax ID?
• Are there links to the terms and conditions and the privacy policy?
• Is the 14-day right of withdrawal described, with a model withdrawal form?
• Does the order button in your checkout state the obligation to pay?

If you check your store before the season anyway, add these seven points to the three in my online store checklist before the season.

If you are not sure about any of them, send me your store's address and I will check it with the same measurements. In the online stores I build, these elements are included from the start.