Cookie Consent and Analytics in Romania: How to Measure Traffic Without Breaking GDPR

Fear of fines makes you drop a generic banner onto your site, copied from somewhere, and hope it's fine. The problem is that most banners you see in Romania are wrong: they load Google Analytics before the visitor clicks anything, or they offer only an "Accept" button. These are exactly the things a data-protection authority can penalise you for.

The good news is you don't have to choose between "compliant" and "useful data". You can have a correct banner and still see where people come from, which pages they read, and where they drop off. In this article I'll explain, in plain business-owner terms rather than legalese, what the law asks, what valid consent looks like, and what options you have to measure traffic with peace of mind.

What the law actually says (no jargon)

In Romania, GDPR applies alongside Law 506/2004 (the local transposition of the ePrivacy directive). The core rule is simple: for any cookie that isn't strictly necessary for the site to work, you need consent before placing it on the visitor's device.

• Essential cookies (shopping cart, login session, language preference): no consent needed.
• Statistics, marketing, remarketing, behaviour-mapping cookies: explicit consent required.

Google Analytics falls into the second group, because it sets cookies and processes visitor data. The authority that checks and issues fines is ANSPDCP. Being a small business doesn't exempt you: the rules are the same for a salon in a small town and for a national store.

What valid consent looks like

A compliant banner isn't just a paragraph and a button. Consent must be:

• Prior: tracking scripts don't fire until the person clicks "Accept". If Analytics loads when the page opens, you've already broken the rule, no matter what the banner text says.
• Granular: the visitor can accept statistics but refuse marketing. Pre-ticked boxes aren't allowed.
• As easy to refuse as to accept: a "Reject all" button must be as visible as "Accept all". A banner with only "Accept" isn't consent, it's coercion.
• Revocable: the person must be able to change their choice at any time, usually through a discreet link in the footer.

If your banner ticks all of these, you're on solid ground.

Google Consent Mode: measure even when people refuse

Many owners assume that if a visitor clicks "Reject", the data is gone entirely. It's not quite that. Google has a mechanism called Consent Mode (version 2) that adjusts behaviour based on the user's choice.

In short: when someone declines statistics cookies, Analytics stops setting cookies and stops collecting personal data, but still sends anonymous, aggregated signals. Google then uses modelling to estimate the unmeasured portion of traffic. It isn't as precise as full data, but you still see real trends.

That gives you what matters most for a local business: where people come from, which campaigns work, and which pages convert, without breaking the law. Setup is done through the consent platform linked to your Analytics account.

The alternative: cookieless analytics

If you want to simplify things entirely, there are analytics tools that don't set cookies and don't track the individual visitor: Plausible, Umami, Matomo (configured privacy-first), or the analytics built into Cloudflare.

The benefit: they collect aggregated, anonymous data, and in most setups they don't trigger the banner requirement for statistics. You see everything that matters for a small business, visitor counts, popular pages, traffic sources, with far less legal hassle.

Mind the nuance: "cookieless" doesn't automatically mean "no obligations at all". You still need to mention the processing in your privacy policy. But you shrink the risk surface a lot. For many of our clients, this combination, privacy-first analytics plus a minimal banner only for marketing, is the cleanest compromise.

The mistakes that actually get you fined

From the sites we take over, the same few mistakes keep repeating:

• Tracking scripts firing before consent. The most common and the easiest to prove.
• A single-button banner, "Accept", with no real refusal option.
• Pre-ticked boxes for marketing.
• No cookie policy that clearly states which cookies you use and why.
• No way to withdraw consent once given.

None of these is hard to fix, but they need to be done correctly at a technical level, not just cosmetically. We deliver sites with a compliant banner and analytics set up right from the start, remotely, anywhere in the country. If you'd like us to review your current site together, message us on WhatsApp and we'll tell you honestly what's fine and what needs changing.