GDPR, cookies, and privacy for business websites in Romania

Any website that collects data — contact forms, newsletters, analytics — falls under GDPR. It is not optional and does not go away if you ignore it. The good news: basic compliance is achievable without ruining the user experience.

Minimum requirements

• Privacy policy — what data you collect, why, how long you keep it, how to contact you
• Terms and conditions — for commercial sites, especially e-commerce
• Cookie banner — if you use analytics or marketing (Google Analytics, Meta Pixel, etc.)
• Explicit consent — checkbox for newsletter, no hidden pre-checked boxes

The contact form

You collect name, email, phone — these are personal data. State in your policy that you use them only to respond to the inquiry. Do not automatically add them to marketing lists without separate consent.

Analytics without paranoia

Google Analytics 4 or privacy-first alternatives (Plausible, Fathom) have different requirements. If you use GA with cookies, the banner must allow refusal — not just accept. Many small businesses choose cookieless analytics for simplicity.

Common mistakes

• Legal text copied from another site without adaptation
• Cookie banner that aggressively blocks the entire site
• No link to the policy in the footer
• Forms that send data without protection or spam filtering

Important note

This article is informational, not legal advice. For complex cases (large e-commerce, sensitive data, health), verification with a GDPR specialist is worth it. For standard business sites, the basics above cover 90% of needs.