Finland

[FI] Supreme Administrative Court upholds consent requirements for national news websites

IRIS 2026-8:1/24

Sergei Bondarev

Independent expert

On 27 August 2026, Finland’s Supreme Administrative Court (Korkein hallinto-oikeus - SAC) upheld consent requirements for tracking-based news personalisation and rejected a cookie consent interface that made refusal less accessible than acceptance. The judgments concerned Sanoma Media Finland Oy (KHO:2026:64) and Otavamedia Oy (KHO:2026:65), respectively.

Both cases concerned section 205 of the Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista), which implements Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended). For the storage of, or access to, information on users’ devices, consent and adequate information are the rule; exceptions include storage or access strictly necessary to provide a service expressly requested by the user. The second case also applied the General Data Protection Regulation’s requirements for freely given consent.

In the Sanoma case, the Finnish Transport and Communications Agency (Traficom) had required consent for specified personalisation and editorial analytics cookies and certain web calls (network requests that used information stored on users' devices). Sanoma argued that personalisation was integral to its digital news service and to editorial freedom.

The court held that visiting a news website did not itself amount to an express request for tracking-based personalisation. Commercial attractiveness did not establish strict necessity. It also rejected the argument that the European Media Freedom Act (EMFA) (Regulation (EU) 2024/1083) created an exception: requiring consent did not determine what news Sanoma published or prevent personalisation with consent.

The court also upheld consent requirements for the web calls at issue, which involved use of data stored on users’ devices. Its ruling did not cover every web call: Traficom had already accepted that some qualified for an exception, while Sanoma had not substantiated an exception for the others.

In the Otavamedia case, Traficom had ordered changes to the consent-management mechanism on suomenkuvalehti.fi. The first layer prominently offered acceptance of all cookies. Refusing non-essential cookies required entering settings and locating a less prominent refusal control among detailed information.

The court assessed this arrangement as a whole. It found that the difference in visibility and effort improperly influenced users’ freedom to refuse, so consent was not freely given. The defect was not the use of two layers as such, but the asymmetry of the mechanism. Compliance with a widely used European standard did not establish compliance with the law.

In both cases, SAC declined to request a preliminary ruling from the Court of Justice of the European Union (CJEU) and dismissed the appeals it examined, leaving the Administrative Court’s outcomes unchanged. Sanoma’s application for leave to appeal was rejected on the remaining issues.