Cookie consent in Norway: what the 2025 ekomloven requires

Which Norwegian law regulates cookies?

Norway is not an EU member, but as part of the European Economic Area it takes over EU rules on data protection and electronic communications. The GDPR applies through the EEA Agreement, and Article 5(3) of the ePrivacy Directive is transposed in national law.

The current rule is section 3-15 of the Electronic Communications Act (lov om elektronisk kommunikasjon, ekomloven) of 13 December 2024, no. 76. This is a new act, not an amendment: it replaced the 2003 Electronic Communications Act and entered into force on 1 January 2025.

Section 3-15 says it is not allowed to store information on, or gain access to information in, the communication equipment of an end user or user unless that person has been informed about, among other things, which information is processed, the purpose of the processing and who processes the information, and has given consent. The second sentence is the change that matters: consent must meet the consent requirements of the GDPR.

What changed on 1 January 2025?

Under the old act, Norwegian sites could treat a browser that accepts cookies as a sign of consent. Nkom explains that, until the new act, it was enough that the browser's default settings allowed cookies. That reading is gone. Consent now has to be freely given, specific, informed and unambiguous, given by an active choice, documented, and as easy to withdraw as to give.

In practice, Norwegian sites that relied on an information-only notice ("this site uses cookies") had to add a real consent step with blocking before consent.

Which cookies are exempt?

The second paragraph of section 3-15 keeps the Directive's two exemptions for technical storage or access:

1. solely for the purpose of transmitting a communication over an electronic communications network; or
2. strictly necessary to provide an information society service at the user's explicit request.

Datatilsynet describes both exemptions as narrow: the second covers storage that is a precondition for delivering the service the user asked for. Session, login, shopping cart, security and load balancing cookies, and the cookie that stores the consent choice, fit here. Analytics and advertising cookies do not, and Norwegian law has no separate exemption for audience measurement, although section 3-15 lets the ministry adopt regulations on exemptions.

Who enforces the cookie rule in Norway?

Section 3-15 has two supervisors. Datatilsynet and Nkom, the Norwegian Communications Authority, share supervision of the provision. According to Datatilsynet, Nkom decides whether a technical solution is covered by the rule and whether an exemption applies, while Datatilsynet assesses whether the information is sufficient and whether the consent meets the GDPR.

Datatilsynet's guidance sets out what it expects of consent: saying no must be as easy as saying yes, and the "no" option must get comparable prominence to the "yes" option.

How high are the fines in Norway?

Section 15-12 of the act lets the authorities impose an administrative fine (overtredelsesgebyr) on persons and companies that intentionally or negligently breach section 3-15, first paragraph. Under section 15-13, the amount depends on the gravity and duration of the breach, the degree of fault and the company's turnover. The act sets no fixed ceiling for it. Orders to correct a breach can also be backed by a coercive fine (tvangsmulkt). Datatilsynet can additionally fine GDPR breaches up to 20 million euros or 4% of worldwide annual turnover.

We found no published fine under section 3-15 as of October 2026. The heaviest Norwegian fines in this area concern consent for advertising data:

Both are GDPR decisions about apps and ad tech rather than website cookies, but they show how Datatilsynet treats consent for advertising data.

What should a cookie banner in Norway do?

A banner that meets section 3-15 and Datatilsynet's expectations:

• holds back every non-exempt cookie, pixel and script until the visitor has chosen;
• says which information is collected, for what purpose and by whom, as section 3-15 lists;
• offers Accept and Reject with comparable prominence on the first layer (the Reject all guide covers the design);
• lets visitors choose by purpose, with nothing pre-ticked;
• makes withdrawal as easy as consent and records each choice.

A notice that only informs, or that relies on browser settings, no longer meets the Norwegian rule.

Does the banner have to be in Norwegian?

We found no rule that sets the language of a private website's cookie banner. The information must be understandable to the user and the GDPR asks for clear and plain language, so a site aimed at Norwegian visitors should present its banner in Norwegian.

How Cookiequiet fits

Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Norwegian (Bokmål) to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting, which covers the whole EEA including Norway, is included on every plan, including Free. The cookie scanner shows which trackers load before any choice.