The Norwegian Parliament (Stortinget) has passed an updated Electronic Communications Act (E-Com Act or Ekomloven), introducing new cookie guidelines that took effect on January 1st, 2025. These changes align Norway’s cookie regulations more closely with the General Data Protection Regulation (GDPR) and the ePrivacy Directive, ensuring stricter user privacy protections.
The previous law allowed pre-ticked boxes or browser settings as consent, which the EU ruled invalid. The new guidelines eliminate ambiguities and brings clarity and consistency in line with EU standards.
If your business operates a website or app targeting Norwegian users, it’s crucial to understand how these updates impact your data collection practices and what steps you need to take to ensure compliance.
Key Changes in the Norwegian Cookie Guideline
The updated law introduces stricter requirements for obtaining and managing user consent. Here’s what’s changing:
- Passive consent is no longer valid – Websites and apps must obtain explicit, informed consent before setting non-essential cookies.
- Consent must meet GDPR standards – It must be freely given, specific, informed, and unambiguous.
- Granular consent options – Users must be able to accept or reject cookies for different purposes rather than giving blanket consent.
- Stricter definition of “necessary” cookies – The term “strictly necessary” replaces “necessary,” potentially reducing the number of cookies exempt from consent requirements.
- Easier consent withdrawal – Users must have a simple way to withdraw or modify their consent at any time.
Who Does the E-Com Act Apply To?
The law applies to any website or app targeting Norwegian users, regardless of where the platform is hosted. Businesses must comply if they:
- Websites under a .no domain
These are explicitly considered to be operating within Norway and are subject to Norwegian law, including the EKOM Act. - Websites or apps in Norwegian
If a website or app is available in Norwegian, it is often seen as targeting Norwegian users, making it subject to Norwegian regulations, including the EKOM Act. - Websites or apps targeting a Norwegian audience
This covers websites or apps that: 1. Advertise to Norwegian users 2. Offer prices in Norwegian kroner (NOK) 3. Have features or marketing explicitly tailored for Norway (e.g., shipping to Norway, using local payment methods) and 4. Collect personal data from Norwegian residents.
Regulators such as the Norwegian Communications Authority (Nkom) and the Norwegian Data Protection Authority (Datatilsynet) will enforce the law and pursue non-compliance cases.
How Businesses Can Ensure Compliance?
To comply with the new cookie law, businesses should take proactive steps to update their cookie policies, banners, and consent management systems. Use this checklist to prepare:
Compliance Checklist for Marketers, Website Admins, and App Developers
- Conduct a Cookie Audit: Use a compliance check tool to identify and categorize all cookies and tracking technologies on your website or app.
- Obtain Explicit User Consent: Ensure users actively agree to non-essential cookies before they are set. Remove pre-ticked boxes and passive consent mechanisms.
- Provide Transparent Cookie Information: Clearly state what cookies are used, what data they collect, their purpose, and who processes the data.
- Offer Granular Consent Options: Allow users to select different categories of cookies (e.g., functional, analytics, marketing) rather than a single “Accept All” option.
- Enable Easy Consent Withdrawal: Provide a simple mechanism for users to change or revoke their cookie preferences at any time.
- Update Privacy Policies: Revise your privacy policy to reflect the new rules, explicitly detailing cookie usage and users’ rights.
- Document and Store Consents: Keep records of user consent to demonstrate compliance in case of regulatory audits.
Failure to comply with the new Norwegian cookie regulations can result in fines and enforcement actions from Nkom and Datatilsynet. Companies that fail to obtain valid user consent or mismanage data collection practices may face: Regulatory fines for non-compliance, Reputation damage from privacy concerns or Legal action from affected users or privacy advocacy groups
Final Thoughts
The updated Norwegian E-Com Act marks a major step toward stricter data privacy and transparency, aligning Norway with broader European regulations. While these changes require businesses to rethink their cookie practices, they also present an opportunity to enhance user trust and compliance with global standards. By proactively updating cookie policies, obtaining clear consent, and ensuring a seamless user experience, businesses can stay ahead of regulatory shifts and foster stronger relationships with their customers.
At Kilowott, we specialize in helping businesses navigate evolving digital regulations with tailored privacy solutions. If you need expert guidance on cookie compliance or consent management, reach out to our team today!
