New rules for cookies

While most of us were busy getting everything done before New Year – in the middle of the race for the almond in the rice pudding – the new Electronic Communications Act was sanctioned by the Council of State. The result? Stricter rules for how cookies are used on Norwegian websites from 1 January (2025).

We know this came suddenly, and that many businesses perhaps did not manage to put down their Christmas preparations before the new rules knocked on the door. That was the case internally for us too, but we have found a good solution that handles the requirements – without lawyers’ fees.

New rules for cookies

First of all, perhaps: what is a «cookie»? Briefly explained, cookies are small packets of data stored on the user’s computer when they visit websites. They are used for everything from remembering logins to analysing user behaviour and targeting ads.

Until now, Norway has had a more liberal set of rules compared with the rest of the EU, and has legally been in a grey zone. Norwegians have had weaker privacy protection than citizens of EU countries. The new rules change that.

Now, all cookies that are not strictly necessary must be switched off by default, and the user must actively give consent to switch them on before using the site. Good news for consumers – perhaps not such good news for businesses with large advertising budgets.

Who does this apply to?

Most websites use cookies in one form or another. Some cookies come with the publishing platform, so that the solution works at all. The so-called «strictly necessary cookies» are essential for websites to function as they should and have little to do with tracking. They enable basic functionality such as user login and account administration.

When it comes to cookies – in relation to the new legislation we are talking about here – the game is really on as soon as your website has a third-party integration. That means embedding or displaying any of the following:

Video from YouTube, Vimeo and the like

Third-party software, such as sign-up forms or newsletters (for example Mailchimp)

Google Analytics (or other analytics tools)

Instagram, TikTok, Facebook or other social media

What do you need to do to comply with the new rules?

Here are the key points from the new regulations:

Consent first (prior consent): No cookies that are not technically necessary may be set without the user’s active consent.

Clear information: The user must understand what they are consenting to. That means you must explain what data is collected, why it is collected, and account for it in the privacy policy on your website.

Easy to say no: It must be as easy to decline cookies as to accept them. Manipulative design (so-called «dark patterns») is not allowed.

Document consent: You must store the consent and be able to show documentation in the event of an audit.

No cookie walls: It must be possible to use your website even if the user says no to cookies, even if functionality may be somewhat reduced.

What happens if you do not follow the rules?

If your website breaks the rules, you risk daily fines and orders for immediate improvements. The Norwegian Data Protection Authority and the Norwegian Communications Authority (NKOM) supervise the regulations.

We help you handle cookies

We have entered into a partnership with CookieInformation, the Nordic region’s leading specialists in GDPR-compliant cookie solutions. This solution complies with the Electronic Communications Act.

Free solution:

You create an account for your business yourself at cookieinformation.com

Free to use, with scanning of one website/domain up to 200 subpages.

The software scans your pages at installation, and adapts the compliant banner based on the first scan. 

Simple integration:

You send us the script and a privacy policy describing the cookies.

We add this to your website (if it was delivered by us).

You are responsible for scanning your pages and keeping the cookie information up to date.

PS. After the trial period ends, you must downgrade to the free version yourself for the cookie banner to keep showing.

Paid solution:

We create an account for your business on our partner page at cookieinformation.com

Scanning of a domain/website with up to 500 subpages. More subpages than this requires an Enterprise solution (separate pricing).

The software scans your pages and adapts a compliant banner, once a week, 52 times a year, with 25,000 unique consents per year. 5 years of data storage (Microsoft Azure).

Google Consent Mode v2 (required by Google if you use Google Analytics). There are good alternatives to «GA» that we can recommend on request.

Price: NOK 3,100 per year per website, setup included. 

Invoiced separately from hosting/web hotel/backup and security certificates (SSL).

Prices excl. VAT.

We integrate the privacy policy and cookie banner for you.

The system ensures that your website’s privacy policy is up to date and complies with the law.

Both solutions store data for as long as the authorities require, with audits in mind. The paid solution is our choice on hallingcast.no and for the side project kantefolflak.no.

We also offer tailor-made cookie banners that are not already part of an ecosystem, but this is costly and strictly speaking unnecessary, as long as there are solutions that handle the legislation well, such as Cookieinformation.com. It is a simple solution we are comfortable recommending to our clients.

Privacy policy template

From my time working for Hallingdal Hytteservice – when the new Norwegian Personal Data Act came into force on 15 June 2018 – I gained some experience with GDPR texts and how to set them up for websites. I have stripped down the original and created a simplified version that your business can (and should) build on and adapt to your needs. It is meant as a simple starting point, and should be quality-checked by a lawyer or the general manager of your company. Download the privacy policy template here (in Norwegian).

In summary

• New rules for data storage on websites (cookies) apply in Norway from 1 January 2025.
• The new rules give Norwegian consumers better control over their own data, but they also require businesses to take privacy seriously.
• We are happy to help you stay ahead, so you can focus on what you do best – running your business.

Contact us and we will find the best solution for your website.