In short. Section 3-15 requires information and prior GDPR-standard consent for storing or accessing device information, except for transmission or strictly necessary delivery of an expressly requested service.
Definition: Under rules effective from 1 January 2025, Section 3-15 of Norway's Electronic Communications Act generally requires information and prior consent before storing information on, or accessing information from, a user's device. Consent must meet the General Data Protection Regulation (GDPR) standard, with exceptions for communication transmission and strictly necessary delivery of an expressly requested service.
Key facts
- Nkom's cookie guidance explains that Section 3-15 covers all kinds of information, including information that is not personal data.
- The Act's Section 3-15 requires users to receive information about what information is processed, its purpose and who processes it.
- Datatilsynet's consent guidance requires consent before cookies or similar technologies are used, including before a cookie is placed.
- The GDPR's Article 7(3) requires withdrawal of consent to be as easy as giving it.
What storage and device access does the rule cover?
A cookie is a small text file stored on a computer when a user opens a website. Nkom's guidance on the provision's scope explains that Section 3-15 is technology neutral: it covers cookies and other technologies that store or retrieve information on communications equipment. Examples of that equipment include mobile phones, tablets and computers.
The same guidance states that the provision applies regardless of whether the information is personal data. It identifies online retailers, media businesses and online advertisers among the businesses covered.
When is consent unnecessary?
Section 3-15, second paragraph exempts technical storage or access in either of these circumstances:
- Its sole purpose is transmitting a communication over an electronic communications network.
- It is strictly necessary to provide an information society service expressly requested by the particular user or end user.
Nkom's explanation of the exceptions says the transmission exception primarily concerns electronic communications providers. For the requested-service exception, use of the cookie must be a prerequisite for delivering the service.
What must a consent mechanism provide?
Section 3-15, first paragraph requires information about the information processed, the processing purpose and the party processing it, alongside consent meeting GDPR requirements.
The GDPR's Article 4(11) defines consent as freely given, specific, informed and unambiguous agreement expressed through a statement or clear affirmative action. Article 7(1) requires the controller, the party responsible for the processing, to be able to demonstrate consent. Article 7(3) gives users the right to withdraw at any time and requires information about that right before consent.
Datatilsynet's practical guidance advises against preselected boxes and acceptance through passivity. Its recommendations include purpose-specific choices and rejection without extra clicks or lower visual prominence.
Which authority supervises the requirements?
Datatilsynet's explanation of oversight assigns Nkom responsibility for assessing whether a technical solution falls within Section 3-15 and whether the exceptions apply. Datatilsynet assesses whether the information is sufficient and whether consent meets GDPR requirements. The business using cookies or similar technologies on its website remains responsible for compliance.
Related terms
- How must a website let visitors withdraw consent under GDPR Article 7?
- GDPR lawful basis for web data
- Analytics consent gaps
FAQ
Does the rule apply to information that identifies nobody?
Yes. Nkom explains that Section 3-15 covers storage and access involving all kinds of information, regardless of whether it is personal data.
Can I use legitimate interests instead of cookie consent?
For storage or access requiring consent under Section 3-15, you must obtain consent. Datatilsynet explains that this specific requirement applies even though GDPR provides alternative legal bases for personal data processing.
Can I place a consent-requiring cookie before the visitor chooses?
No. Datatilsynet requires consent before the cookie is placed or the similar technology is used.
Sources
- Nkom, "Informasjonskapsler/cookies", 16 May 2025
- Lovdata, "Lov om elektronisk kommunikasjon (ekomloven)", 13 December 2024, Section 3-15
- Datatilsynet, "Samtykke til bruk av informasjonskapsler og andre sporingsteknologier", 3 April 2025
- European Parliament and Council, "General Data Protection Regulation", 27 April 2016, Articles 4 and 7
Check how a page reads to answer engines. Open the GEO score analyzer