The legal requirements of a website

Romanian Law no. 365/2002 on electronic commerce (Article 5) requires the provider of an online service to give visitors easy, direct, permanent and free access to at least the following information:

• name and registered office (or domicile);
• phone, e-mail address and any other means of direct contact;
• Trade Register number and tax identification code;
• the competent authority, if the activity is subject to authorisation;
• for regulated professions, the professional title and professional body;
• prices, stating which taxes and delivery costs are included.

In practice, the details appear in the footer of every page and, in full, on a dedicated page (Impressum or Contact).

Any website that receives personal data (through forms, bookings, orders or statistics services) must inform visitors in accordance with Article 13 of Regulation (EU) 2016/679 (GDPR). The privacy policy states:

• who the controller is and how to contact them;
• what data is processed, for what purpose and on what legal basis (contract, legal obligation, legitimate interest, consent);
• who receives the data and whether it leaves the European Economic Area;
• how long it is kept;
• the visitor's rights and the possibility of a complaint to the supervisory authority (ANSPDCP in Romania).

The text must describe what the website actually does. A copied template that mentions unused services or omits the ones in use does not meet the requirement.

Romanian Law no. 506/2004 (Article 4(5) and (6)), read together with the GDPR, allows only cookies strictly necessary for the website to work without consent. Statistics and marketing cookies (Google Analytics, Meta, TikTok or LinkedIn pixels) require the visitor's prior consent.

A correct consent mechanism:

• loads no statistics or marketing service before a choice is made;
• makes refusing as easy as accepting;
• allows a separate choice per category, without pre-ticked boxes;
• allows consent to be withdrawn at any time;
• comes with a list of cookies, stating the purpose and duration of each.

A contact form does not need a consent box in order to answer a request: the legal basis is the person's own request (Article 6(1)(b) GDPR). Information, through a link to the privacy policy, is however mandatory, and the fields must be limited to what is necessary.

Subscribing to a newsletter or commercial messages, on the other hand, requires separate, explicit consent, which cannot be a condition for submitting the form.

Government Emergency Ordinance no. 34/2014 on consumer rights sets out what buyers must be told before placing an order:

• the main characteristics of the product or service;
• the total price, including all taxes, and delivery costs;
• payment and delivery arrangements;
• the 14-day right of withdrawal, its conditions and the model withdrawal form;
• the legal guarantee of conformity and, if any, the commercial guarantee.

The final order button must clearly indicate that placing the order involves an obligation to pay (for example, "Order with obligation to pay"), and the order confirmation is sent on a durable medium, usually by e-mail. The terms and conditions and the returns policy complete this information.

ANPC Order no. 449/2022, as amended by Order no. 270/2026, requires traders that conclude contracts with consumers to display on their website the ADR (alternative dispute resolution) icon, 250 × 50 pixels, with a working link to the reclamatiisal.anpc.ro platform. The official icon can be downloaded free of charge from the ANPC website.

The European ODR (online dispute resolution) platform was closed on 20 July 2025 by Regulation (EU) 2024/3228; links to it must be removed from websites.

For a presentation website through which no contracts are concluded with consumers, the icon is, in principle, not mandatory.

Law no. 232/2022, which transposes the European Accessibility Act, has applied since 28 June 2025 to e-commerce services offered to consumers as well. Online shops must also be usable by people with disabilities: alternative texts for images, sufficient contrast, keyboard navigation, forms with clear labels and an accessibility statement.

Microenterprises providing services (fewer than 10 employees and annual turnover or balance sheet total of no more than EUR 2 million) are exempt. Even so, an accessible website is easier for every visitor to use and better understood by search engines.

The legal pages are part of every Temyro project and are adapted to each client's activity, not copied from a template:

• identification details, in the footer and on a dedicated page;
• the privacy policy and the cookie policy, matching the services actually used;
• the consent window by category, with statistics services loaded only after consent;
• for shops: terms and conditions, returns policy, withdrawal form and the ADR icon.

Check what your website already has, free of charge, with the website check.