> ## Documentation Index > Fetch the complete documentation index at: https://docs.botbrains.io/llms.txt > Use this file to discover all available pages before exploring further. # AI Cold Calling Laws in Romania > Is AI cold calling legal in Romania? Law 506/2004 requires prior express consent for automated calls to people and companies, and no do-not-call list exists. export const reviewed_0 = "October 2026" In Romania, an AI agent may only make marketing calls to people and businesses who gave prior, express consent to receive them. [Art. 12 of Law 506/2004](https://legislatie.just.ro/Public/DetaliiDocument/288598) bans commercial calls through automated systems without that consent, and it covers both consumers and companies. Romania has no do-not-call register, so there is no list to screen and no opt-out route for automated calls. The data protection authority ANSPDCP enforces the rule. This page summarizes the law as of {reviewed_0} to help you plan AI phone calls. It isn't legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign. ## At a glance | Call | To consumers (B2C) | To businesses (B2B) | | - | - | - | | Inbound service call | Allowed. Disclose the AI and the recording. | Allowed. Disclose the AI and the recording. | | Outbound service call | Allowed | Allowed | | Marketing callback the person asked for | Allowed. Stay within what they asked for. | Allowed. Stay within what they asked for. | | Marketing call by an AI agent | Consent required. This includes existing customers, because the customer exception covers email only. | Consent required. Art. 12(4) covers companies too. This includes existing customers, because the customer exception covers email only. | | Marketing call by a human | Unclear. The wording and the European Commission point to consent, but ANSPDCP fines these calls under the GDPR, for a missing legal basis or an ignored objection. Get consent to be safe. | Unclear. Art. 12(4) applies the same rule to companies, whichever reading wins. ANSPDCP has rejected complaints from companies in the past. | ## Is AI cold calling legal in Romania? Only with prior express consent, for consumers and companies alike. [Art. 12(1) of Law 506/2004](https://legislatie.just.ro/Public/DetaliiDocument/288598) reads: > "Este interzisă efectuarea de comunicări comerciale prin utilizarea unor sisteme automate de apelare și comunicare care nu necesită intervenția unui operator uman \[...] cu excepția cazului în care abonatul sau utilizatorul vizat și-a exprimat în prealabil consimțământul expres pentru a primi asemenea comunicări." In English: the law prohibits commercial communications through automated calling and communication systems that don't need a human operator. The only exception is prior express consent from the subscriber or user concerned. **The rule covers companies.** Art. 12(4) extends it to subscribers that are legal persons, so it covers consumers, sole traders, and companies alike. There is no B2B exception. **AI agents count.** No Romanian regulator or court has ruled on conversational AI agents yet. An AI agent that runs the call alone doesn't need a human operator, so treat it as automated, even when a human supervises or can take over. The rule also covers "any other method" that uses public electronic communications services, so a different label for the AI agent won't help. **ANSPDCP enforces it.** In August 2026, it fined a retailer 50,000 lei under Art. 12(1) for automated sales calls without consent (see [Fines and enforcement](#fines-and-enforcement)). ## Cold calls by a human The ePrivacy Directive lets each country choose opt-in or opt-out for marketing calls by a human ([Art. 13(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)). Art. 12(1) doesn't name calls by a human. Its catch-all covers any other method that uses public electronic communications services ("orice altă metodă care folosește serviciile de comunicații electronice destinate publicului"). No court ruling or ANSPDCP guidance says whether a call by a human falls under it, so two readings exist: | Reading | Support | What it means for you | | - | - | - | | The catch-all covers calls by a human | The wording, since a phone call uses a public electronic communications service. The law that Law 506/2004 replaced banned unsolicited marketing calls "prin orice alte metode" without prior express consent ([Law 676/2001, Art. 15](https://legislatie.just.ro/Public/DetaliiDocument/32739)). The European Commission lists Romania as opt-in for calls by a human ([2017 evaluation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52017SC0005), Table 5, and its [Deloitte study](https://digital-strategy.ec.europa.eu/en/library/evaluation-and-review-directive-200258-privacy-and-electronic-communication-sector), Table 45). | Consent required. You need prior express consent, as for AI calls. | | Art. 12(1) covers only communications without a human, and the GDPR governs calls by a human | [Linklaters, May 2026](https://www.linklaters.com/en/insights/data-protected/data-protected---romania), written by Kinstellar, finds no rule for calls by a human. A [2015 study for the Commission](https://op.europa.eu/en/publication-detail/-/publication/573b8f74-7220-41d7-9e4b-477ab1d45e29/language-en) (p. 101) leaves Romania off its list of opt-in countries. ANSPDCP's recent cases match this reading. | Allowed. You need a GDPR legal basis, such as legitimate interest ([Recital 47](https://eur-lex.europa.eu/eli/reg/2016/679/oj)), and you must stop as soon as someone objects ([Art. 21(3)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). | **How ANSPDCP enforces it.** ANSPDCP uses Art. 12(1) for calls without a human. In 2026, it fined Amato Bestseller 50,000 lei for calls by automated systems "care nu necesită intervenția unui operator uman" ([press release](https://www.dataprotection.ro/?page=Comunicat_Presa_06.08.2026\&lang=ro)). In every other marketing call case we found since 2018, it applied the GDPR instead: * **Telekom Romania, 2021.** A human representative called a former customer. ANSPDCP warned Telekom for calling without a legal basis (Art. 6) and fined it 9,851 lei for ignoring his objection (Art. 21) ([press release](https://www.dataprotection.ro/?page=Comunicat_Presa_13_/_05_/_2021\&lang=ro)). * **PPC Energie Muntenia, 2025.** A partner called a person for marketing, using a number that PPC had shared without a legal basis. ANSPDCP fined PPC 9,950 lei under Art. 5 and 6 ([press release](https://www.dataprotection.ro/?page=Comunicat_Presa_10.02.2025\&lang=ro)). * **Dormeo Home, 2026.** Twice, the company kept calling people who had objected. ANSPDCP fined it 5,236 lei under Art. 6 and 21(3) in May ([press release](https://www.dataprotection.ro/?page=Comunicat_Presa_16.06.2026\&lang=ro)) and 10,517 lei under Art. 21 in August, for calls and texts ([press release](https://www.dataprotection.ro/?page=Comunicat_Presa_08_09_2026\&lang=ro)). One older case points the other way. In its [2015 annual report](https://www.dataprotection.ro/servlet/ViewDocument?id=1249) (p. 84), ANSPDCP says it fined a company under Law 506/2004 for commercial communications without the prior consent of the people it called from a bought database. The report doesn't say whether a human made the calls. **Calls to companies.** Art. 12(4) applies Art. 12(1) to subscribers that are legal persons, so the same two readings apply to B2B calls. Under the GDPR reading, Law 506/2004 doesn't restrict a human who calls a company. The GDPR still applies when you call a named person, such as an employee on a direct line. In practice, ANSPDCP has said its powers protect only natural persons ([2011 annual report](https://www.dataprotection.ro/servlet/ViewDocument?id=790), p. 39). It has also rejected complaints from companies about unsolicited communications ([2012 annual report](https://www.dataprotection.ro/servlet/ViewDocument?id=870), p. 37). **What to do.** Prior consent is the only approach that's safe under both readings. If you rely on the GDPR reading instead, document your legitimate interest and call only numbers you obtained lawfully. At the start, say who you are and that the person can object, and honor an objection at once. Every GDPR fine in this section followed a missing legal basis or an ignored objection. ## Existing customers and callback requests **Existing customers.** Art. 12(2) lets you market similar products to customers whose email address you got during a sale, with a free opt-out. That exception covers email only. For AI calls to existing customers, you need consent, for example a separate, empty checkbox at checkout that the customer ticks. **Callbacks.** A person who asks for a callback consents to that call. Log the request with its timestamp, phone number, and form version, and say on the form that an AI agent will call. Stay within the topic they asked about. Ads that lead to a landing page where people request an AI callback are the cleanest way to start. **Service calls.** Art. 12 covers commercial communications only. Appointment reminders, order updates, and support follow-ups need a GDPR legal basis, such as your contract, but no marketing consent. Keep offers out of these calls. ## Do-not-call register: None in Romania Romania has no national do-not-call or Robinson register for phone calls. Law 506/2004 doesn't create one, and the guides we reviewed ([DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=electronic-marketing\&c=RO), [Linklaters](https://www.linklaters.com/en/insights/data-protected/data-protected---romania)) name none. Opt-outs work company by company: | Rule | What you do | | - | - | | Objections ([GDPR Art. 21(3)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)) | When someone asks you to stop calling, stop all marketing calls to them. Keep your own suppression list and check it before every campaign. | | Phone directories ([Law 506/2004 Art. 11(6) and (7)](https://legislatie.just.ro/Public/DetaliiDocument/288598)) | Consent required. Using directory entries beyond a contact lookup needs each subscriber's prior express consent, companies included. Don't build call lists from phone books. | Use [guidance](/concepts/guidance) to tell the agent how to handle objections, and a [Unitool](/concepts/unitools) to write each objection to your CRM. botBrains doesn't screen numbers for you. ## Consent for AI calls | Requirement | What it means | | - | - | | Prior | You collect it before the first call ([Art. 12(1)](https://legislatie.just.ro/Public/DetaliiDocument/288598)). | | Express | An active opt-in, such as a checkbox the person ticks. Silence and pre-ticked boxes don't count ([GDPR Art. 4(11) and Recital 32](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). | | Specific | It names automated or AI calls, the purpose, and your company. | | Names partners | If other companies will rely on the consent, the form names each one ([EDPB Guidelines 05/2020](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en), para. 65). | | Provable | You carry the burden of proof ([GDPR Art. 7(1)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). ANSPDCP fined Artmark Holding 10,000 lei because it couldn't prove prior express consent for marketing emails ([ANSPDCP](https://dataprotection.ro/index.jsp?lang=en\&page=Comunicat_Presa_Amenda_Artmark)). | Keep the consent text, the collection method, and proof per contact: timestamp, phone number, and form version. Romanian law sets no retention period or expiry for consent, so keep the evidence for as long as you call the number. **Purchased lists.** A generic vendor opt-in that doesn't name your company and automated calls isn't enough. Before you buy, ask the vendor for the exact consent text, the collection method, and proof per contact. Before you start, read [what botBrains needs for outbound campaigns](/concepts/phone/countries#before-you-start-outbound-campaigns). ## Tell callers they're talking to an AI Since August 2, 2026, [Article 50 of the EU AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#art_50) requires that people know they're talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can't count on the exception for obvious cases when your AI agent sounds human. The [default introduction](/concepts/phone#introductions) already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the [Consumer Rights Directive](https://eur-lex.europa.eu/eli/dir/2011/83/oj/eng) also requires you to name your company, anyone you call for, and the commercial purpose at the start. We found no Romanian rule that adds to the AI Act for calls. Consumer law adds a rule for sales calls to consumers. At the start of the call, state your company, on whose behalf you call, and the commercial purpose ([Consumer Rights Directive Art. 8(5)](https://eur-lex.europa.eu/eli/dir/2011/83/oj), which Romania transposed in Government Emergency Ordinance 34/2014). A recommended [introduction](/concepts/phone#introductions) in Romanian for outbound marketing calls: ```text theme={null} Bună ziua, sunt {agent_name}, un agent AI care vă sună din partea {project_name}. Vă sun în legătură cu [scopul apelului], așa cum ați acceptat pe [sursa consimțământului]. Convorbirea este înregistrată. Dacă nu sunteți de acord, apăsați oricând tasta steluță. Dacă nu mai doriți apeluri de la noi, spuneți-mi și nu vă vom mai suna. ``` For inbound calls: ```text theme={null} Bună ziua, ați sunat la {project_name}. Sunt {agent_name}, un agent AI. Convorbirea este înregistrată. Dacă nu sunteți de acord, apăsați oricând tasta steluță. Cu ce vă pot ajuta? ``` ## Call recording You don't need consent to record a call you take part in. Your company takes part through its AI agent. | Rule | Source | | - | - | | Participants: allowed. A participant may record the call.
Anyone else: consent required. They need the prior written consent of all participants. | [Law 506/2004 Art. 4(2)](https://legislatie.just.ro/Public/DetaliiDocument/288598) | | Allowed. Businesses may record calls in lawful professional practice to prove a commercial transaction. | Law 506/2004 Art. 4(4) | | Allowed. Recording a private conversation isn't a crime for a participant with a legitimate interest. | [Criminal Code Art. 226(4)(a)](https://legislatie.just.ro/Public/DetaliiDocument/109855) | | Prohibited. Intercepting a phone call without a right to do so carries up to 3 years in prison. | Criminal Code Art. 302(2) | The GDPR still applies. You need a legal basis, such as legitimate interest, and you must tell the caller at the start ([GDPR Art. 6 and 13](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). The botBrains introduction tells the caller about the recording. When the caller presses the star key, botBrains stops the recording and discards it. The transcript stays. botBrains stores recordings, transcripts, and call data in the EU. A voice recording isn't biometric data unless you process it to identify the person ([GDPR Art. 4(14) and Art. 9](https://eur-lex.europa.eu/eli/reg/2016/679/oj)), so recording for quality doesn't count. ## Caller ID and calling hours We found no Romanian rule that sets calling hours, a frequency cap, or a special prefix for marketing calls. The caller sees your botBrains phone number, and botBrains provides Romanian numbers on request. botBrains doesn't enforce calling hours, so pick reasonable times yourself. Repeated calls can still be unlawful: Romania's Law 363/2007 transposes the EU ban on "persistent and unwanted solicitations by telephone" ([Unfair Commercial Practices Directive, Annex I, point 26](https://eur-lex.europa.eu/eli/dir/2005/29/oj)). On voicemail, the agent hangs up without leaving a message. ## Sector rules | Rule | Applies to | Source | | - | - | - | | The contract binds the consumer only after they sign your offer or send written consent. You confirm the offer on a durable medium. | Every consumer contract closed by phone, including electricity and gas supply ([CRD Art. 3(1)](https://eur-lex.europa.eu/eli/dir/2011/83/oj)) | Government Emergency Ordinance 34/2014, Art. 8(6), per [Romania's notification to the European Commission](https://commission.europa.eu/document/download/1c3f17ad-2925-4e5d-ad7e-14dc6b8c3af6_en?filename=RO%20Regulatory%20choices%20EN%20version_1.pdf) | | Separate distance-selling rules apply instead. | Financial services ([CRD Art. 3(3)(d)](https://eur-lex.europa.eu/eli/dir/2011/83/oj)) | Sector law | We found no sector-specific telemarketing ban. We couldn't confirm extra phone-sales rules from the energy regulator ANRE or other sector regulators, so check them before you start. ## Fines and enforcement | Authority | Enforces | Maximum | | - | - | - | | [ANSPDCP](https://www.dataprotection.ro) | Law 506/2004 Art. 12 (Art. 13(1)(q) and 13(5)) and the GDPR | 5,000 to 100,000 lei per offense (Art. 13(2)). For companies with more than 5 million lei turnover, up to 2% of turnover. GDPR fines reach EUR 20 million or 4% of turnover ([Art. 83](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). | | [ANPC](https://anpc.ro) | Consumer protection law | We couldn't confirm the fine ranges. | Some consumer guides send robocall complaints to ANCOM, the telecommunications regulator, but Art. 13(5) gives Art. 12 to ANSPDCP. Recent ANSPDCP cases: | Date | Company | Fine | Why | | - | - | - | - | | August 2026 | Amato Bestseller SRL | 50,000 lei under Art. 12(1). 285,395 lei in total with GDPR fines. | Automated commercial calls without prior express consent ([press release](https://www.dataprotection.ro/?page=Comunicat_Presa_06.08.2026\&lang=ro)) | | August 2026 | Dormeo Home SRL | 10,517 lei (about EUR 2,000) under GDPR Art. 21 | Marketing calls and texts after the person objected, a second fine that year ([StartupCafe](https://startupcafe.ro/gdpr-romania-o-firma-a-primit-o-amenda-de-2-000-eur-pentru-sms-uri-si-apeluri-telefonice-a-doua-sanctiune-in-cateva-luni-106406)) | A bill to amend Law 506/2004 is before Parliament, aimed at cookie consent ([Avocatnet, April 2026](https://avocatnet.ro/articol_71793/Noi-reguli-privind-consim%C8%9B%C4%83mantul-pentru-cookie-uri-propuse-la-Parlament-Alinierea-legisla%C8%9Biei-romane-la-standardele-europene.html)). We found no proposal to change Art. 12. ## Sources * [Law 506/2004 on privacy in electronic communications, consolidated](https://legislatie.just.ro/Public/DetaliiDocument/288598), Art. 2, 4, 11, 12, and 13 * [Law 676/2001 on privacy in telecommunications](https://legislatie.just.ro/Public/DetaliiDocument/32739), Art. 15, repealed by Law 506/2004 * [Criminal Code (Law 286/2009)](https://legislatie.just.ro/Public/DetaliiDocument/109855), Art. 226 and 302 * [Romania's regulatory choices under the Consumer Rights Directive](https://commission.europa.eu/document/download/1c3f17ad-2925-4e5d-ad7e-14dc6b8c3af6_en?filename=RO%20Regulatory%20choices%20EN%20version_1.pdf), Government Emergency Ordinance 34/2014, Art. 8(6) * [Consumer Rights Directive 2011/83/EU](https://eur-lex.europa.eu/eli/dir/2011/83/oj), Art. 3 and 8 * [Unfair Commercial Practices Directive 2005/29/EC](https://eur-lex.europa.eu/eli/dir/2005/29/oj), Annex I, point 26, and its [Romanian transposition, Law 363/2007](https://eur-lex.europa.eu/legal-content/EN/NIM/?uri=CELEX:32005L0029) * [ePrivacy Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2002/58/oj), Art. 13 * [GDPR (Regulation 2016/679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Art. 4, 6, 7, 9, 13, 21, and 83 * [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) * ANSPDCP press releases: [Amato Bestseller](https://www.dataprotection.ro/?page=Comunicat_Presa_06.08.2026\&lang=ro), [Telekom Romania](https://www.dataprotection.ro/?page=Comunicat_Presa_13_/_05_/_2021\&lang=ro), [PPC Energie Muntenia](https://www.dataprotection.ro/?page=Comunicat_Presa_10.02.2025\&lang=ro), [Dormeo Home, May 2026](https://www.dataprotection.ro/?page=Comunicat_Presa_16.06.2026\&lang=ro), [Dormeo Home, August 2026](https://www.dataprotection.ro/?page=Comunicat_Presa_08_09_2026\&lang=ro), [Artmark Holding](https://dataprotection.ro/index.jsp?lang=en\&page=Comunicat_Presa_Amenda_Artmark) * ANSPDCP annual reports: [2011](https://www.dataprotection.ro/servlet/ViewDocument?id=790), [2012](https://www.dataprotection.ro/servlet/ViewDocument?id=870), [2015](https://www.dataprotection.ro/servlet/ViewDocument?id=1249) * European Commission: [ePrivacy Directive evaluation, SWD(2017) 5](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52017SC0005), Table 5, the [Deloitte study](https://digital-strategy.ec.europa.eu/en/library/evaluation-and-review-directive-200258-privacy-and-electronic-communication-sector) behind it, Table 45, and the [2015 study](https://op.europa.eu/en/publication-detail/-/publication/573b8f74-7220-41d7-9e4b-477ab1d45e29/language-en), p. 101 * [Linklaters, Data Protected: Romania](https://www.linklaters.com/en/insights/data-protected/data-protected---romania) * [DLA Piper, electronic marketing in Romania](https://www.dlapiperdataprotection.com/index.html?t=electronic-marketing\&c=RO) * [StartupCafe on the Dormeo Home fine](https://startupcafe.ro/gdpr-romania-o-firma-a-primit-o-amenda-de-2-000-eur-pentru-sms-uri-si-apeluri-telefonice-a-doua-sanctiune-in-cateva-luni-106406) ## Next steps Set up your phone line, introductions, and outbound calls. Compare consent rules for AI calls across the EU, the UK, and the US. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.