October 27, 2026. Bulgaria lets you send unsolicited commercial email to companies without their prior consent, but not to any address a company has entered in the opt-out register run by the Commission for Consumer Protection (KZP), and not to consumers at all without prior consent. Every unsolicited message must be recognisable as unsolicited the moment it arrives. KZP's online checker compares up to 100,000 addresses per request against the register. Breaches cost 250 to 1,500 leva for a person and 500 to 2,000 leva for a company, about EUR 128 to EUR 767 and EUR 256 to EUR 1,023 at the 1.95583 rate that has applied since Bulgaria adopted the euro on 1 January 2026.
Key numbers
| Item | Number |
|---|---|
| Addresses per KZP register check (per request) | 100,000 |
| Fine for a person, Electronic Commerce Act art 24 (about EUR 128 to EUR 767) | 250 to 1,500 leva |
| Sanction for a company or sole trader (about EUR 256 to EUR 1,023) | 500 to 2,000 leva |
| Repeat breach within a year, person | 500 to 2,500 leva |
| Repeat breach within a year, company | 1,000 to 4,000 leva |
| Fine for ignoring an opt-out, art 340 (about EUR 2,556 to EUR 5,113) | 5,000 to 10,000 leva |
| Official conversion rate since 1 January 2026 | 1.95583 leva per euro |
Statute text read on 27 October 2026 in the Electronic Commerce Act (amended to 16 June 2026) on kzp.bg and the Electronic Communications Act (amended to 13 February 2026) on crc.bg; register rules from kzp.bg; rate from EUR-Lex.
What the Electronic Commerce Act says
Article 6 of the Electronic Commerce Act, in the consolidated text KZP publishes (amended to State Gazette issue 55 of 16 June 2026), has four parts:
- Label it. Commercial email sent without the recipient's prior consent must be clearly and unambiguously recognisable as unsolicited as soon as it arrives.
- A register for companies. KZP keeps an electronic register of the email addresses of legal persons that do not want unsolicited commercial communications.
- Registered addresses are off limits. Sending unsolicited commercial communications to an address in that register is prohibited.
- Consumers need consent. Sending unsolicited commercial communications to consumers without their prior consent is prohibited.
Article 24 sets the fines for breaching Article 6: 250 to 1,500 leva for an individual and 500 to 2,000 leva for a company or sole trader, rising to 500 to 2,500 leva and 1,000 to 4,000 leva (at most about EUR 1,278 and EUR 2,045) for a repeat breach within a year of a prior penalty. Under Bulgaria's euro changeover law, leva amounts in existing laws now read as euros at the 1.95583 rate fixed by Council Regulation (EU) 2025/1409.
How the KZP register works
The register is for businesses, not individuals. A representative with a profile on the KZP portal files an electronic application listing the company's email addresses and domains, with a declaration of ownership. A KZP officer checks it, and the addresses are protected from the date of registration, which can come after the filing date. Senders check lists with the register's online form, which takes up to 100,000 addresses per request and confirms each match. KZP handles email spam only (calls, Viber and WhatsApp go to the Communications Regulation Commission), and a consumer reporting spam must declare that the address is used for personal needs.
The consent rule in the Electronic Communications Act
Article 261 of the Electronic Communications Act (text on crc.bg, amended to 13 February 2026) allows calls, messages or email for direct marketing, with or without human intervention, only with the prior consent of the consumer, which the Act defines as a natural person using a service outside their occupation, business or profession. A seller may email its own customers about similar products if it lets them object, free and easily, at the sale and afterwards, and it must honour every refusal: ignoring one is fined 5,000 to 10,000 leva, about EUR 2,556 to EUR 5,113 (Article 340). Every marketing message must identify the sender and carry a valid address for opt-out requests.
What it means for operators
- Check every Bulgarian company address against the KZP register before each campaign and treat a match as do not email for that company.
- Label the message as unsolicited in the subject line or first line. The Act requires recognition on arrival but prescribes no wording.
- Leave consumers out. Personal addresses need prior consent under both Acts.
- Name the sender and give a working opt-out address in every email, and suppress refusals in every tool you send from.
- Treat named contacts as personal data. GDPR still applies to firstname@company addresses: record a lawful basis, give the Article 14 notice and answer objections. Senders outside the EU also need a GDPR representative.
Send from authenticated domains on proper email infrastructure and budget the email hosting cost. Compare other markets in our cold email laws by country guide, or see what a cold email agency costs per month. This is a summary of public documents, not legal advice.
Frequently Asked Questions
Yes, to companies. Bulgaria's Electronic Commerce Act allows unsolicited commercial email to legal persons without prior consent, as long as the message is clearly recognisable as unsolicited on arrival and the address is not in the KZP register of companies that refuse such messages. Email to consumers needs their prior consent.
It is the Commission for Consumer Protection's register of the email addresses and domains of organisations that do not want unsolicited commercial communications. Companies register online, senders can check up to 100,000 addresses per request with KZP's form, and sending to a registered address is prohibited.
Under Article 24 of the Electronic Commerce Act, 250 to 1,500 leva for an individual and 500 to 2,000 leva for a company, about EUR 128 to EUR 767 and EUR 256 to EUR 1,023 at 1.95583 leva per euro. A repeat breach within a year of a prior penalty costs 500 to 2,500 or 1,000 to 4,000 leva, and ignoring an opt-out is fined 5,000 to 10,000 leva under the Electronic Communications Act.
Yes. Article 6(4) of the Electronic Commerce Act bans unsolicited commercial communications to consumers without prior consent, and Article 261 of the Electronic Communications Act allows marketing email to consumers only with prior consent, except a seller's messages to its own customers about similar products with a free, easy way to object.