What a Business Website Legally Needs in Bulgaria & the EU

Most small business owners I talk to think of "legal stuff" as a cookie banner someone pastes in at the end. In 2026 that's no longer enough — and in Bulgaria the rules have shifted twice this year alone: prices went euro-only in August, and a new "withdraw from the contract here" function for online contracts was adopted in September. This is the plain-language checklist I work through on every site I build, so you know what your website must show before it goes live (or before someone complains).

Who you are: company and contact information

Bulgaria's Electronic Commerce Act (Article 4) says a business offering services online must give visitors easy, direct and permanent access to basic information about itself. In practice that means a clearly linked "Company info" or "Contacts" page — not a line hidden in a PDF.

• Company or trader name, exactly as registered.
• Registered seat and management address, plus the address where you actually operate, if different.
• Phone and email that someone actually answers.
• Registration details — for a Bulgarian company, the UIC (ЕИК) in the Commercial Register.
• VAT number, if you're VAT-registered.
• The supervisory authority, if your activity is licensed, and professional details for regulated professions (lawyers, doctors, architects, accountants).

The same Article adds that any prices you show must be clear and state whether they include taxes and other charges. Which brings us to the euro.

Prices: euro only since 9 August 2026

Bulgaria joined the euro on 1 January 2026, and the mandatory period of showing prices in both leva and euro ended on 8 August 2026. From 9 August, the price you sell and charge at is the euro price. You may still show a leva amount as a reference, but only as information — it must not be the price, and it must not confuse anyone.

Privacy policy (GDPR)

If your website has a contact form, a newsletter signup, a booking system, analytics or a shop, you process personal data — so under GDPR (Article 13) you must tell people, at the moment you collect it, what you do with it. A privacy policy linked in the footer and next to every form covers that. It should say, in plain words:

• who is responsible for the data (your company and contact details);
• what you collect and why, and on what legal basis (e.g. to answer an enquiry, to fulfil an order, with consent for newsletters);
• who else receives it — hosting provider, courier, payment provider, email or analytics tools;
• how long you keep it;
• people's rights (access, correction, deletion, objection) and their right to complain to the Bulgarian Commission for Personal Data Protection (КЗЛД).

A copied template that mentions tools you don't use — or forgets the ones you do — is one of the most common problems I see.

Cookies: consent before analytics and pixels

Under Bulgaria's Electronic Communications Act (Article 4a), which implements the EU ePrivacy rules, storing or reading anything on a visitor's device needs prior, informed consent — unless it's strictly necessary for the service they asked for (a shopping basket, a login, remembering their cookie choice). Google Analytics, the Meta pixel, TikTok and ad remarketing tags are not strictly necessary.

1. Nothing loads before a choice. Analytics and pixels stay blocked until the visitor clicks "Accept". This is where most sites fail: the banner is there, but the scripts fire anyway.
2. "Reject" is as easy as "Accept". Same level, same visibility — not hidden behind "Settings".
3. No pre-ticked boxes. Consent must be an active choice.
4. Change of mind is possible. A small "Cookie settings" link in the footer lets people withdraw consent at any time.
5. A cookie policy lists what you use, what each cookie does and how long it lasts.

Online shops: terms, pre-contract information and returns

If you sell to consumers online, the Bulgarian Consumer Protection Act adds a layer on top. Before the customer orders, they must be able to see the main characteristics of the product, the total price including taxes and delivery, payment and delivery terms, and information about their right of withdrawal. Most shops put this in terms and conditions (общи условия) plus clear product and checkout pages.

New: the "withdraw from the contract here" function

An EU directive (2023/2673) added a new rule to the Consumer Rights Directive that has applied across the EU since 19 June 2026: for contracts concluded through an online interface, the trader must offer an easy online withdrawal function. Bulgaria's Parliament adopted the matching changes to the Consumer Protection Act at final reading on 10 September 2026; they enter into force on publication in the State Gazette, with some provisions from 27 September 2026. For your shop, it means:

• A clearly labelled function such as "withdraw from the contract here", easy to find and available for the whole withdrawal period.
• The customer states or confirms their name, the order and the email for the confirmation.
• A separate confirmation button completes the withdrawal.
• You send an acknowledgement without undue delay — by email is fine — with the content and the date and time it was sent.

One thing you can remove: the link to the EU Online Dispute Resolution (ODR) platform. The platform shut down on 20 July 2025 and the obligation to link to it was repealed, so an old link in your footer now leads nowhere.

Accessibility: a short pointer

Since June 2025, the European Accessibility Act covers e-commerce and several other consumer services, so many online shops must also meet accessibility requirements (very small service businesses are exempt). I won't repeat it here — I wrote a full guide: The European Accessibility Act is checking websites now. If you sell online, read it after this one.

Your 20-minute legal check for today

Open your own website on your phone and go through this list. Every "no" is a task.

• Can I find the company name, address, ЕИК and phone within two taps?
• Are all prices in euro only, with VAT and delivery clear?
• Is there a privacy policy linked from the footer and next to every form — and does it name the tools I really use?
• Do analytics and pixels stay off until I accept? (Open the site in a private window, don't click the banner, and see whether your ads dashboard still records a visit.)
• Is "Reject" as easy as "Accept", and can I change my choice later?
• Shop only: are terms, delivery costs and the 14-day withdrawal info visible before ordering?
• Shop only: is there a working "withdraw from the contract here" function, and is the dead ODR link gone?

A compliant website isn't a wall of legal text. It's a site where the right information is one tap away and nothing happens behind the visitor's back.— the principle I build every site around

How I handle this on client projects

Every website I build includes the structure for all of the above: a proper company-info page, footer links, forms with the privacy notice beside them, a cookie setup that really blocks scripts until consent, euro-only prices, and — for shops — the pages and checkout steps consumer law expects, now including the withdrawal function. You (or your lawyer) supply or approve the final legal texts; I make sure they're in the right place and that the site behaves the way they say. Websites start from €890 and go live in 2–5 weeks with three months of free care — details on my web design page.

Not sure where your current site stands? Run the free website check — it looks at speed, mobile, SEO basics and accessibility in a couple of minutes. Send me the result together with the answers from the checklist above, and I'll tell you whether a few fixes are enough or it's time for a new site.