← ALL REGULATIONS
Cookie consent in Norway, under the new ekomlov.
Norway has required GDPR-standard consent before non-essential cookies since 1 January 2025, when the new Electronic Communications Act (ekomloven) came into force. Browser settings that allow cookies no longer count as consent. Nkom and Datatilsynet share supervision of the cookie rule in § 3-15.
Ekomloven at a glanceOpt-in before tracking
- Applies to
- Storing or reading any information on a user’s device, whether or not it is personal data
- Cookie rule
- Electronic Communications Act (LOV-2024-12-13-76), § 3-15
- In force
- 1 January 2025, replacing the 2003 Act
- Enforced by
- Nkom for the rule’s scope and exemptions, Datatilsynet for information and consent
- Penalties
- Infringement fines (overtredelsesgebyr) under the Act, weighed by seriousness, duration, fault and turnover, plus GDPR fines
WHAT EKOMLOVEN REQUIRES
What Nkom and Datatilsynet expect under § 3-15.
THE RULEConsent to the GDPR standardUntil 2025 it was enough that a browser’s settings allowed cookies. Now consent must be freely given, specific, informed, unambiguous, given by an active choice, documented, and as easy to withdraw as to give.
WITH KATLAIn GDPR mode, the cookie guard refuses every cookie outside the functional category until the visitor chooses, and deletes any that were set before it ran. Each decision is stored with its categories, its time and a truncated IP address, and can be queried and exported through the API, CLI or MCP server. Katla keeps the latest decision per visitor.
THE RULEThe exemptions are narrowOnly storage for transmitting a communication, or what is strictly necessary for a service the user explicitly asked for, is exempt. Nkom decides whether a technology falls under the rule or an exemption.
WITH KATLAOnly the functional category runs before a choice. Katla classifies each cookie it finds, and you can move one to another category if its purpose calls for consent.
THE RULEReject on the same layer as acceptDatatilsynet’s guide says the option to refuse must sit in the same layer as the accept button, with no extra clicks and no "are you sure?" pop-ups. It also recommends a close X that counts as no consent, in addition to the reject option.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected. There is no separate close X.
THE RULEEasy to withdraw, and say soWithdrawing must be as easy as consenting, and visitors should be told how to do it.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
Ekomloven questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- What changed on 1 January 2025?
- The new Electronic Communications Act replaced the 2003 Act, and its cookie rule, § 3-15, requires consent that meets the GDPR standard. Before, it was enough that the browser’s default settings allowed cookies; now the visitor has to make an active choice.
- Who enforces the cookie rule in Norway?
- Nkom, the Norwegian Communications Authority, and Datatilsynet share it. Nkom decides whether a technology is covered and whether an exemption applies; Datatilsynet decides whether the information and the consent meet the GDPR.
- Does the rule apply if no personal data is collected?
- Yes. § 3-15 covers storing and reading any information on the user’s device, whether it is personal data or not.
- Is a cookie wall allowed in Norway?
- No. Datatilsynet says making access to a site or service depend on consent leaves the visitor no real choice, so the consent is not valid.
- Can the banner be in Norwegian?
- Yes. Katla’s banner and generated policies are available in Norwegian Bokmål, and the widget can follow the visitor’s browser language.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.