KHO - KHO:2026:64

Summary

The Supreme Administrative Court of Finland ruled that Sanoma Media Finland Oy violated the national provision implementing Article 5(3) of the ePrivacy Directive by failing to obtain user consent for the storage and use of cookies and web requests on its websites. The court found the interpretation of the directive sufficiently clear and did not refer the case to the CJEU. It also held that web requests, which can access user identifiers, IP addresses, and browser information, constitute gaining access to information stored in the user's terminal equipment, thus requiring consent.

Full text

Help KHO - KHO:2026:64: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 11:57, 1 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators151 edits Tag: Decisions [1.0] (No difference) Latest revision as of 11:57, 1 September 2026 KHO - KHO:2026:64 Court: KHO (Finland) Jurisdiction: Finland Relevant Law: Article 5(3) ePrivacy Directive 2002/58/ECLaki sähköisen viestinnän palveluista 205 § Decided: 27.08.2026 Published: 27.08.2026 Parties: Sanoma Media Finland Oy National Case Number/Name: KHO:2026:64 European Case Law Identifier: ECLI:FI:KHO:2026:64 Appeal from: Helsingin HAO (Administrative Court of Helsinki)9.10.2024 nro 5845/2024 Appeal to: Not appealed Original Language(s): Finnish Original Source: KHO (in Finnish) Initial Contributor: av The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive 2002/58/EC by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A media company that provides news services did not request user context for the placement and use of cookies or certain web requests on several websites it managed. In June 2023, the Finnish Transport and Communications Agency issued a decision where it found that the company had violated Section 205(1) of the Finnish Act on Electronic Communications Services, a provision implementing Article 5(3) of the ePrivacy Directive 2002/58/EC. The agency held that consent was required for both the cookies and the web requests, as these were not necessary within the meaning of the infringed provision. The company appealed the decision of the agency to an administrative court, which dismissed the appeal. Following this, the company appealed the decision of the administrative court to the Supreme Administrative Court. In addition, the company requested the Supreme Administrative Court to refer the case to the CJEU for a preliminary ruling on the interpretation of Article 5(3) ePrivacy Directive to clarify whether the provision also applies to web requests. Holding The court dismissed the controller's appeal and stated that there were no grounds to amend the decision of the administrative court. First, the court held that there was no need to refer the case to the CJEU for a preliminary ruling – it considered the interpretation of the ePrivacy Directive to be sufficiently clear. Second, the court came to the same conclusion as the previous instances regarding the placement and use of cookies on the company's websites. The court held that the company had violated Section 205(1) of the Act on Electronic Communications Services, as the use of cookies was not necessary for the company within the meaning of Section 205(2). Moreover, the court interpreted the exception in Section 205(2) narrowly and pointed out that the wording of Article 5(3) ePrivacy Directive indicates that the threshold for applying the exception is intended to be quite high. The matter did not require a different assessment due to considerations related to freedom of speech or the role of pluralistic and independent media. Finally, the court held that the company should also have obtained users’ consent for the web requests. A web request allows the recipient to create a user identifier as well as to gain access to e.g. the user’s IP address, browser information, and cookie data. According to the court, web requests therefore constitute the gaining of access to information stored in the terminal equipment of a user within the meaning of Article 5(3) ePrivacy Directive. The court argued web requests could not be considered to fall outside the scope of the provision simply because their technical operating principles differ from those of cookies. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. The Supreme Administrative Court had to decide whether a media company that provided news services could be required to make cookies related to the personalized delivery of news content on its websites subject to consent. As a general rule, the storage of cookies or other data describing the use of the service on a user’s device, and the use of such data, required the user’s consent and appropriate notification. The threshold for deviating from the general rule was intended to be high, and no grounds for such a deviation were found in this case. The matter did not warrant a different assessment based on considerations related to freedom of speech or the role of the media. Freedom of speech did not, in and of itself, imply that a news service provider should be permitted to collect and use information pertaining to the private lives of users of its websites. Nor did the imposed obligation interfere with the pluralistic and independent media services guaranteed by law, nor with the free flow of reliable information, nor did the obligation restrict the company’s right to decide what content it publishes and when. Nor did the obligation prevent the provision of journalistic content in a personalized manner based on the user’s consent and the provision of information. The case also raised the question of whether the provision regarding user consent applied not only to cookies but also to certain online invitations. Section 205(1) and (2) and Section 330 of the Act on Electronic Communications Services Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC (Electronic Communications Data Protection Directive), Article 1(1) and Article 5(3) Decision Subject to Appeal Helsinki Administrative Court, October 9, 2024, No. 5845/2024 Decision of the Supreme Administrative Court 1. The Supreme Administrative Court grants Sanoma Media Finland Oy leave to appeal insofar as the matter concerns making personalization and delivery cookies, as well as web beacons, subject to consent, and will examine the case in these respects. The requests for an oral hearing and for a preliminary ruling from the Court of Justice of the European Union are denied. The appeal is dismissed. The final outcome of the Administrative Court’s decision remains unchanged. 2. The application for leave to appeal is dismissed in all other respects. The Supreme Administrative Court therefore does not rule on the appeal in these respects. 3. Sanoma Media Finland Oy’s claim for reimbursement of legal costs is dismissed. Background of the Case In its decision of June 8, 2023, the Finnish Transport and Communications Agency found that Sanoma Media Finland Oy (hereinafter also “Sanoma”) had violated Section 205(1) of the Act on Electronic Communications Services (the Communications Services Act). The decision was based, among other things, on the fact that that several websites managed by the company do not request user consent regarding the placement and use of cookies related to the personalized delivery of digital news service content and delivery analytics cookies, nor do they request user consent as referred to in Section 205 of the Communications Services Actas defined in Section 205 of the Communications Services Act, even though they are not necessary in the manner intended by the provision. Pursuant to Section 330(1) of the Communications Services Act, the Finnish Transport and Communications Agency has required Sanoma to make the non-essential cookies referred to in the decision—which are used on its websites— as well as technologies t

Entities