In short. Finnish websites need consent for cookies unless they solely enable message transmission or are necessary for a service the user specifically requests.
Definition: On a Finnish business website, storing or using cookies requires consent unless the sole purpose is transmitting messages through a communications network or the cookies are necessary to provide a service the user specifically requests. These exceptions appear in Section 205 of Finland's Act on Electronic Communications Services.
Key facts
- Section 205 requires consent and comprehensible, complete information about the purposes of storing or using cookies.
- Traficom's service-provider guidance, dated 1 September 2021, requires consent before non-essential cookies are set.
- Traficom's Cookies page states that legitimate interest under the General Data Protection Regulation (GDPR) provides no permission to store cookies.
- In KHO:2026:64, dated 27 August 2026, Finland's Supreme Administrative Court describes a high threshold for exceptions and upholds the consent requirement for the personalised news cookies at issue.
Which cookies can operate without consent?
The Act's Section 205 provides separate exceptions for storage or use solely enabling message transmission and for storage or use necessary to deliver a specifically requested service. Even exempt storage and use must remain within the extent required for the service and restrict privacy only as necessary.
Traficom's Cookies page gives shopping-cart contents, access to secure areas and information security as examples of essential functions. It recommends informing visitors about essential cookies even where consent is unnecessary.
The service-provider guidance assesses purpose rather than cookie names. Session authentication can qualify; adding tracking or targeted advertising to that cookie requires consent. Necessary chat cookies can qualify once a visitor opens the chat window, when that action requests the additional service.
Do analytics and advertising cookies require consent?
Traficom's guidance requires consent for profiling and targeted-advertising cookies. For analytics to qualify as essential, the provider must justify necessity and protect privacy, including ensuring that analytics data are neither shared with third parties nor capable of identifying individuals. If those requirements cannot be met, consent is required. Anonymisation alone supplies no blanket exemption.
In KHO:2026:64, the Supreme Administrative Court upholds the requirement to obtain consent for cookies used in personalised news delivery. The court finds no basis for an exception in that case; freedom of expression and media freedom leave that conclusion unchanged.
What must the consent controls provide?
Traficom's Cookies page requires a clear description of cookie types, purposes and validity periods, with information about third-party access. Consent involves an affirmative action. Browser settings or continued browsing supply no valid consent, and non-essential options must start unselected. The mechanism must offer a simple refusal option.
In KHO:2026:65, also dated 27 August 2026, the Supreme Administrative Court finds a consent mechanism unlawful where acceptance is prominently available immediately while refusal takes materially more time and effort. In the case examined, accepting all cookies is possible on the first level; refusing requires opening settings, scrolling down and pressing a refusal button.
Related terms
- Which website cookies fall within the ePrivacy consent exemption?
- Analytics consent gaps
- How must a website let visitors withdraw consent under GDPR Article 7?
- Does an AI referral change analytics cookie consent requirements?
FAQ
Are first-party cookies automatically exempt?
No. Traficom's guidance assesses what the cookie does and why its data are used; a cookie's name or type alone cannot establish necessity.
Does using local storage avoid these rules?
No. The same Traficom guidance applies the same rules to comparable technologies, including local storage and session storage.
How must you let visitors change their choice?
Traficom's Cookies page describes reopening settings through an accessible icon or link. Withdrawal or changed settings must actually remove or overwrite the previously stored data.
Sources
- Ministry of Transport and Communications, "Act on Electronic Communications Services", English translation completed 26 January 2023
- Traficom, "Guidelines for service providers", 1 September 2021
- Traficom, "Cookies", updated 23 April 2026
- Supreme Administrative Court of Finland, "KHO:2026:64", 27 August 2026
- Supreme Administrative Court of Finland, "KHO:2026:65", 27 August 2026
- Finlex, "Act on Electronic Communications Services", translation record completed 26 January 2023
Check how a page reads to answer engines. Open the GEO score analyzer