← ALL REGULATIONS
Cookie consent in Finland, under section 205.
Finland requires consent before a site stores or uses cookies that are not strictly necessary, under section 205 of the Act on Electronic Communications Services. Traficom supervises the rule and says legitimate interest is no basis for cookies; the Data Protection Ombudsman supervises the personal data they collect.
Traficom at a glanceOpt-in before tracking
- Applies to
- Service providers established and operating in Finland
- Cookie rule
- Act on Electronic Communications Services (917/2014), section 205
- Enforced by
- Traficom for section 205, the Data Protection Ombudsman for the GDPR
- Guidance
- Traficom guidelines for service providers, 11 November 2022
- Penalties
- Traficom can order a provider to put its consent right. Deliberately failing to ask for consent is punishable by a fine under section 349.
WHAT TRAFICOM REQUIRES
What Traficom expects from a Finnish cookie banner.
THE RULENo legitimate interest for cookiesSection 205 allows cookies with consent, or without it only when strictly necessary for a service the user asked for. Traficom says a controller’s legitimate interest is not a lawful ground for cookies or similar tracking.
WITH KATLAIn GDPR mode, the cookie guard refuses every cookie outside the functional category until the visitor chooses, and deletes any that were set before it ran.
THE RULEAnalytics usually needs consentTraficom does not treat analytics as essential by default. A provider that claims it is has to justify it, and make sure the data is not shared with third parties and cannot identify anyone.
WITH KATLAKatla treats analytics as a consent category, which is what Traficom’s guidance expects in most cases.
THE RULERefusal on the top levelIf the top level of the banner offers "Accept all", it must also offer a way to continue with essential cookies only, alongside more detailed choices. No pre-ticked boxes, and no switches already set to on.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULEA way back to the settingsWithdrawing consent or changing settings must be as simple as possible. Traficom suggests reopening the banner from an icon or a link on the site.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
Traficom questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Do browser settings count as consent in Finland?
- No. On 8 April 2021 the Helsinki Administrative Court ruled that browser settings allowing cookies are not specific, informed consent, and Traficom’s guidance follows that ruling.
- Who supervises cookies in Finland?
- Traficom supervises section 205 for providers established in Finland. The Data Protection Ombudsman supervises the GDPR, which covers the personal data cookies collect; in 2020 the Deputy Ombudsman ordered a company to change a banner that treated continued browsing as consent.
- Has Traficom acted against Finnish sites?
- Yes, and it publishes its decisions. In November 2023 it found that Telia Finland set cookies regardless of visitors’ choices and made accepting easier than refusing, and in June 2024 it ordered A-lehdet to add a way to refuse non-essential cookies to the first layer of the banner on one of its sites.
- Is this the same law as the Information Society Code?
- Yes. Act 917/2014 used to be called the Information Society Code (tietoyhteiskuntakaari), and older guidance still uses that name.
- Can the banner be in Finnish?
- Yes. Katla’s banner and generated policies are available in Finnish and Swedish, and the widget can follow the visitor’s browser language.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.