Skip to main content
In Romania, an AI agent may only make marketing calls to people and businesses who gave prior, express consent to receive them. Art. 12 of Law 506/2004 bans commercial calls through automated systems without that consent, and it covers both consumers and companies. Romania has no do-not-call register, so there is no list to screen and no opt-out route for automated calls. The data protection authority ANSPDCP enforces the rule.
This page summarizes the law as of October 2026 to help you plan AI phone calls. It isn’t legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.

​
At a glance

Only with prior express consent, for consumers and companies alike. Art. 12(1) of Law 506/2004 reads:
“Este interzisă efectuarea de comunicări comerciale prin utilizarea unor sisteme automate de apelare și comunicare care nu necesită intervenția unui operator uman […] cu excepția cazului în care abonatul sau utilizatorul vizat și-a exprimat în prealabil consimțământul expres pentru a primi asemenea comunicări.”
In English: the law prohibits commercial communications through automated calling and communication systems that don’t need a human operator. The only exception is prior express consent from the subscriber or user concerned. The rule covers companies. Art. 12(4) extends it to subscribers that are legal persons, so it covers consumers, sole traders, and companies alike. There is no B2B exception. AI agents count. No Romanian regulator or court has ruled on conversational AI agents yet. An AI agent that runs the call alone doesn’t need a human operator, so treat it as automated, even when a human supervises or can take over. The rule also covers “any other method” that uses public electronic communications services, so a different label for the AI agent won’t help. ANSPDCP enforces it. In August 2026, it fined a retailer 50,000 lei under Art. 12(1) for automated sales calls without consent (see Fines and enforcement).

​
Cold calls by a human

The ePrivacy Directive lets each country choose opt-in or opt-out for marketing calls by a human (Art. 13(3)). Art. 12(1) doesn’t name calls by a human. Its catch-all covers any other method that uses public electronic communications services (“orice altă metodă care folosește serviciile de comunicații electronice destinate publicului”). No court ruling or ANSPDCP guidance says whether a call by a human falls under it, so two readings exist: How ANSPDCP enforces it. ANSPDCP uses Art. 12(1) for calls without a human. In 2026, it fined Amato Bestseller 50,000 lei for calls by automated systems “care nu necesită intervenția unui operator uman” (press release). In every other marketing call case we found since 2018, it applied the GDPR instead:
  • Telekom Romania, 2021. A human representative called a former customer. ANSPDCP warned Telekom for calling without a legal basis (Art. 6) and fined it 9,851 lei for ignoring his objection (Art. 21) (press release).
  • PPC Energie Muntenia, 2025. A partner called a person for marketing, using a number that PPC had shared without a legal basis. ANSPDCP fined PPC 9,950 lei under Art. 5 and 6 (press release).
  • Dormeo Home, 2026. Twice, the company kept calling people who had objected. ANSPDCP fined it 5,236 lei under Art. 6 and 21(3) in May (press release) and 10,517 lei under Art. 21 in August, for calls and texts (press release).
One older case points the other way. In its 2015 annual report (p. 84), ANSPDCP says it fined a company under Law 506/2004 for commercial communications without the prior consent of the people it called from a bought database. The report doesn’t say whether a human made the calls. Calls to companies. Art. 12(4) applies Art. 12(1) to subscribers that are legal persons, so the same two readings apply to B2B calls. Under the GDPR reading, Law 506/2004 doesn’t restrict a human who calls a company. The GDPR still applies when you call a named person, such as an employee on a direct line. In practice, ANSPDCP has said its powers protect only natural persons (2011 annual report, p. 39). It has also rejected complaints from companies about unsolicited communications (2012 annual report, p. 37). What to do. Prior consent is the only approach that’s safe under both readings. If you rely on the GDPR reading instead, document your legitimate interest and call only numbers you obtained lawfully. At the start, say who you are and that the person can object, and honor an objection at once. Every GDPR fine in this section followed a missing legal basis or an ignored objection.

​
Existing customers and callback requests

Existing customers. Art. 12(2) lets you market similar products to customers whose email address you got during a sale, with a free opt-out. That exception covers email only. For AI calls to existing customers, you need consent, for example a separate, empty checkbox at checkout that the customer ticks. Callbacks. A person who asks for a callback consents to that call. Log the request with its timestamp, phone number, and form version, and say on the form that an AI agent will call. Stay within the topic they asked about. Ads that lead to a landing page where people request an AI callback are the cleanest way to start. Service calls. Art. 12 covers commercial communications only. Appointment reminders, order updates, and support follow-ups need a GDPR legal basis, such as your contract, but no marketing consent. Keep offers out of these calls.

​
Do-not-call register: None in Romania

Romania has no national do-not-call or Robinson register for phone calls. Law 506/2004 doesn’t create one, and the guides we reviewed (DLA Piper, Linklaters) name none. Opt-outs work company by company: Use guidance to tell the agent how to handle objections, and a Unitool to write each objection to your CRM. botBrains doesn’t screen numbers for you. Keep the consent text, the collection method, and proof per contact: timestamp, phone number, and form version. Romanian law sets no retention period or expiry for consent, so keep the evidence for as long as you call the number. Purchased lists. A generic vendor opt-in that doesn’t name your company and automated calls isn’t enough. Before you buy, ask the vendor for the exact consent text, the collection method, and proof per contact. Before you start, read what botBrains needs for outbound campaigns.

​
Tell callers they’re talking to an AI

Since August 2, 2026, Article 50 of the EU AI Act requires that people know they’re talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can’t count on the exception for obvious cases when your AI agent sounds human. The default introduction already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the Consumer Rights Directive also requires you to name your company, anyone you call for, and the commercial purpose at the start. We found no Romanian rule that adds to the AI Act for calls. Consumer law adds a rule for sales calls to consumers. At the start of the call, state your company, on whose behalf you call, and the commercial purpose (Consumer Rights Directive Art. 8(5), which Romania transposed in Government Emergency Ordinance 34/2014). A recommended introduction in Romanian for outbound marketing calls:
For inbound calls:

​
Call recording

You don’t need consent to record a call you take part in. Your company takes part through its AI agent. The GDPR still applies. You need a legal basis, such as legitimate interest, and you must tell the caller at the start (GDPR Art. 6 and 13). The botBrains introduction tells the caller about the recording. When the caller presses the star key, botBrains stops the recording and discards it. The transcript stays. botBrains stores recordings, transcripts, and call data in the EU. A voice recording isn’t biometric data unless you process it to identify the person (GDPR Art. 4(14) and Art. 9), so recording for quality doesn’t count.

​
Caller ID and calling hours

We found no Romanian rule that sets calling hours, a frequency cap, or a special prefix for marketing calls. The caller sees your botBrains phone number, and botBrains provides Romanian numbers on request. botBrains doesn’t enforce calling hours, so pick reasonable times yourself. Repeated calls can still be unlawful: Romania’s Law 363/2007 transposes the EU ban on “persistent and unwanted solicitations by telephone” (Unfair Commercial Practices Directive, Annex I, point 26). On voicemail, the agent hangs up without leaving a message.

​
Sector rules

We found no sector-specific telemarketing ban. We couldn’t confirm extra phone-sales rules from the energy regulator ANRE or other sector regulators, so check them before you start.

​
Fines and enforcement

Some consumer guides send robocall complaints to ANCOM, the telecommunications regulator, but Art. 13(5) gives Art. 12 to ANSPDCP. Recent ANSPDCP cases: A bill to amend Law 506/2004 is before Parliament, aimed at cookie consent (Avocatnet, April 2026). We found no proposal to change Art. 12.

​
Sources

​
Next steps

Phone integration

Set up your phone line, introductions, and outbound calls.

Calling laws by country

Compare consent rules for AI calls across the EU, the UK, and the US.