November 2, 2026. Romania requires express prior consent for commercial email under article 12(1) of Law 506/2004, and the text makes no exception for business addresses. The exception in the text, as quoted by the EU Court of Justice in November 2025, is the existing customer rule in article 12(2). On that quotation, breaches are fined 5,000 to 100,000 lei, or up to 2% of turnover for companies above 5,000,000 lei. The regulator, ANSPDCP, announced on 6 August 2026 a 50,000 lei fine under the same article for automated sales calls made without consent.
Key numbers
| Item | Number |
|---|---|
| Fine range for breaching article 12 (Law 506/2004 art 13, as quoted by the CJEU in November 2025) | 5,000 to 100,000 lei |
| Turnover above which the 2% cap applies (fine up to 2% of turnover) | 5,000,000 lei |
| Amato Bestseller fine under article 12(1) (automated sales calls, announced August 2026) | 50,000 lei |
| Money Seeds fine under article 12 (emails after an objection, announced January 2026) | 5,000 lei |
| Inteligo Media newsletter fine (GDPR, 2019) (case C-654/23) | 42,714 lei |
| Court of Justice ruling in Inteligo Media (free account tied to paid access counted as a sale context) | 13 November 2025 |
| Lei per euro implied by ANSPDCP, August 2026 (52,310 lei = 10,000 euro in the same release) | 5.231 |
Law 506/2004 as quoted in CJEU case C-654/23 on EUR-Lex, and ANSPDCP press releases on dataprotection.ro, read on 2 November 2026.
What article 12 of Law 506/2004 says
The Romanian text is quoted in English in the Court of Justice judgment of 13 November 2025 in Inteligo Media v ANSPDCP, which is where we read it:
- Express consent first. Article 12(1) prohibits commercial communications "by using automated calling and communication systems which do not require the involvement of a human operator, by fax or by electronic mail" or any other public electronic communications method, "unless the subscriber or user concerned has given his or her express consent to the receipt of such communications in advance". The text makes no exception for business addresses, so we would treat a work address as covered.
- The customer exception. Under article 12(2), a business that obtains a customer's email address directly when selling a product or service may email that customer about its own similar products or services, provided it offers an easy, free way to object both when it collects the address and in every message, and the customer did not object at the start.
- The fines. As quoted by the Court, article 13 sets a fine of 5,000 to 100,000 lei for breaching article 12, which the Court put at about €984 to €19,697. For companies with turnover above 5,000,000 lei the fine can reach 2% of turnover, so a business turning over 20,000,000 lei could face up to 400,000 lei (a hypothetical). We could not load the current consolidated text to check for later changes.
What the EU court added in November 2025
The Inteligo Media case began in September 2019, when ANSPDCP fined the publisher of avocatnet.ro, a site on new Romanian legislation, 42,714 lei under the GDPR because it could not prove express consent from 4,357 users to the processing of their data. Those users had opened a free account that gave them two extra free articles a month and a free daily newsletter, with paid access to all articles as an option. On those facts the Court of Justice ruled that the address was obtained "in the context of the sale of a product or a service", that the newsletter was direct marketing for similar products or services, and that when a sender relies on that customer exception, the GDPR's lawful-basis conditions in article 6(1) "are not applicable". Our reading, on similar facts: a free account tied to paid products can support marketing emails about similar products, with the opt-out offered every time. It does not cover a bought list or a scraped address.
Recent ANSPDCP fines under article 12
- Money Seeds, announced January 2026. In an investigation concluded in 2025, ANSPDCP found the company had emailed commercial messages to a person who had objected and gave no simple, free way to object. It fined the company 5,000 lei under article 12(1) and (2) and 10,178 lei under articles 12 to 14 of the GDPR (ANSPDCP release).
- Amato Bestseller, announced August 2026. The company made commercial communications using automated calling and communication systems that need no human operator, calling and holding conversations with a significant number of people who had not given prior express consent (our translation). The article 12(1) fine was 50,000 lei, about €9,558 at the 5.231 lei per euro implied by the same release, on top of GDPR fines of 235,395 lei (ANSPDCP release). The release does not say whether the system used AI; on our reading, the wording of article 12(1) would also cover an AI voice agent calling with no person on the line.
What it means for operators
- Get consent before the first email to a Romanian address, including role and company inboxes, unless the person is your customer under article 12(2).
- Use the customer rule narrowly: your own similar products, an address you collected yourself at a sale, and an opt-out in every message.
- Honour objections fast. Money Seeds was fined after emailing someone who had objected.
- Apply the same consent rule to automated calls. Article 12(1) treats them like email, and the Amato fine was for automated calls.
For sending to contacts who did consent, see our email infrastructure service and the email hosting cost breakdown for the mailbox side. For automated calls, see AI calling built around consent. Compare Bulgaria, Finland, Poland and the cold email laws by country table. This is general information, not legal advice.
Frequently Asked Questions
Generally not without express prior consent. Article 12(1) of Law 506/2004 prohibits commercial email unless the recipient gave express consent in advance. The exception in article 12(2) lets a business email its own customers about similar products if it offers an easy, free opt-out when collecting the address and in every message.
Article 12(1) protects the subscriber or user concerned and its text makes no exception for business addresses, so we would treat a company or role address as needing consent too. The exception in the text quoted by the Court of Justice is the customer rule in article 12(2).
As quoted by the Court of Justice in November 2025, a breach of article 12 is fined 5,000 to 100,000 lei, or up to 2% of turnover for companies with turnover above 5,000,000 lei. ANSPDCP's two 2026 announcements under the article were 5,000 lei for emails sent after an objection and 50,000 lei for automated sales calls.
On the facts of Inteligo Media (C-654/23, 13 November 2025), yes: a free account that came with free articles, a free newsletter and optional paid access was obtained in the context of a sale, so the newsletter could rely on the customer exception, with an opt-out every time. Other set-ups were not decided.