Cookie consent in Finland: what section 205 requires

Which Finnish law regulates cookies?

Finland transposes Article 5(3) of the ePrivacy Directive in section 205 of the Act on Electronic Communications Services (laki sähköisen viestinnän palveluista, 917/2014), originally called the Information Society Code. The act entered into force on 1 January 2015 and replaced the Act on the Protection of Privacy in Electronic Communications, whose section 7 held the cookie rule before.

Section 205 has three paragraphs:

1. A service provider may store cookies or other data concerning the use of the service on the user's terminal device, and use that data, if the user has consented and the provider gives the user understandable and complete information about the purposes.
2. This does not apply to storage or use whose sole purpose is to enable the transmission of messages in communications networks, or that is necessary for the provider to deliver a service the subscriber or user has specifically requested.
3. Storage and use are allowed only to the extent the service requires, and may not limit privacy more than necessary.

Consent follows the GDPR definition: freely given, specific, informed and unambiguous, by a clear affirmative action.

Do browser settings count as consent in Finland?

No. For years Finnish authorities accepted consent through browser settings. That ended with two decisions of the Helsinki Administrative Court on 8 April 2021 (H1515/2021 and H1516/2021), which held that default or edited browser settings are not specific and informed consent. The court also confirmed that Traficom is the competent authority for cookie rules and for interpreting consent under section 205. Traficom's guidelines of 1 September 2021 were written on the basis of those decisions, together with the Office of the Data Protection Ombudsman.

Which cookies need consent in Finland?

Traficom's guidance assesses cookies by purpose rather than by name:

• Exempt: session authentication, shopping cart and form contents, security cookies such as login-attempt limits and CAPTCHAs, accessibility features, language and display choices within a session, and load balancing cookies needed to route connections.
• Consent needed: targeted advertising and profiling, social media plugins that set cookies for users who do not use them, embedded third-party content, and analytics.
• Chat widgets: cookies may be set only once the user opens the chat window, not on page load.

On analytics, the guidance says these cookies cannot be considered essential from the user's point of view. A provider that claims an exemption must give clear grounds and protect privacy, for example by sharing no analytics data with third parties and making sure no individual user can be identified; otherwise consent is required. Legitimate interest is never a valid basis for cookies.

What must a Finnish cookie banner do?

Traficom's guidelines set out the banner in detail:

• No non-essential cookie may be set before the user has made a choice. If the user ignores the banner and keeps browsing, only essential cookies may be used.
• Refusing must be as easy as accepting. If the first level offers "Accept all", it must also offer a way to continue with essential cookies only (see the Reject all guide).
• No pre-ticked boxes or switches in the ON position.
• The banner must state the types of cookies, the purpose of each, the validity period of each, and whether data goes to third parties, who they are and what is sent.
• Making the site conditional on accepting non-essential cookies is inappropriate.
• Withdrawal must be as easy as consent, for example through an icon visible on every page, and must actually delete or overwrite the stored data.
• Proof of consent should include the date and time, how consent was asked, what information was shown and an identifier of the user or device.

Who enforces cookie rules in Finland?

Traficom supervises section 205 and handles complaints from users. The Data Protection Ombudsman is the authority for the processing of personal data, including location data. Traficom has published decisions on cookie practices since 2021, among them Valco (25 February 2021), Posti (20 April 2022), Nordea Bank (16 December 2022), Sanoma Media Finland (8 June 2023), Telia Finland and XXL Sports & Outdoor (21 November 2023), Otavamedia (26 April 2024), Lippupiste (28 May 2024), A-lehdet (7 June 2024), Foreca (26 June 2024) and Silmäasema (16 October 2025). The 56-page Sanoma decision of 8 June 2023 shows how strict Traficom is: first-party newsroom analytics and personalization cookies were not exempt, accepting all took one click while refusing took two, cookie lifetimes were missing from the banner, a first-party video analytics cookie lived 20 years, and withdrawing consent left advertising cookies active. Traficom ordered a reject option on the first layer and shorter lifetimes. Some decisions, including Telia's, were appealed to the administrative court.

How high are the fines in Finland?

Traficom states that it cannot impose administrative fines for unlawful cookie practices. It can require a provider to fix a breach within a reasonable time and enforce that order with a conditional fine, a threat of suspending the activity, or a threat of having the correction made at the provider's expense. Separately, section 349 of the act makes it an electronic communications data protection violation, punishable by a criminal fine (sakko), to store or use data contrary to section 205 or to neglect the consent and information duties of section 205(1). GDPR breaches handled by the Data Protection Ombudsman's sanctions board can reach 20 million euros or 4% of worldwide annual turnover.

Does the banner have to be in Finnish?

The act requires information that is understandable, without naming a language. Finland has two national languages, and Traficom publishes its own pages in Finnish, Swedish and English. A site aimed at Finnish visitors should present its banner in Finnish, and in Swedish for a Swedish-speaking audience.

How Cookiequiet fits

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table with each cookie's purpose and lifetime, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Finnish or Swedish to visitors whose browser asks for it, among 24 languages. The consent log records the date, choice, banner version and a hashed IP, and geo-targeting is included on every plan, including Free. The cookie scanner shows what loads before any choice.