KHO - KHO:2026:64

Summary

The Supreme Administrative Court of Finland upheld a ruling against a media company for violating the ePrivacy Directive. The company had failed to obtain user consent for storing and using cookies and web requests on its websites. The court found no need to refer the case to the CJEU for clarification, deeming the directive's interpretation sufficiently clear.

Full text

Help KHO - KHO:2026:64: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 12:38, 1 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators155 edits Tag: Visual edit← Older edit Latest revision as of 13:32, 1 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators155 editsTag: Visual edit Line 92: Line 92: }}}} The Supreme Administrative Court held that a media company had violated the national provision implementing [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive 2002/58/EC] by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites.The Supreme Administrative Court held that a media company had violated the national provision implementing [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive] by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites. == English Summary ==== English Summary == Latest revision as of 13:32, 1 September 2026 KHO - KHO:2026:64 Court: KHO (Finland) Jurisdiction: Finland Relevant Law: Article 5(3) ePrivacy Directive 2002/58/ECLaki sähköisen viestinnän palveluista 205 § Decided: 27.08.2026 Published: 27.08.2026 Parties: Sanoma Media Finland Oy National Case Number/Name: KHO:2026:64 European Case Law Identifier: ECLI:FI:KHO:2026:64 Appeal from: Helsingin HAO (Administrative Court of Helsinki)9.10.2024 nro 5845/2024 Appeal to: Not appealed Original Language(s): Finnish Original Source: KHO (in Finnish) Initial Contributor: av The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A media company that provides news services did not request user context for the placement and use of cookies or certain web requests on several websites it managed. In June 2023, the Finnish Transport and Communications Agency issued a decision where it found that the company had violated Section 205(1) of the Finnish Act on Electronic Communications Services (917/2014), a provision implementing Article 5(3) of the ePrivacy Directive 2002/58/EC. The agency held that consent was required for both the cookies and the web requests, as these were not necessary within the meaning of the infringed provision. The company appealed the decision of the agency to an administrative court, which dismissed the appeal. Following this, the company appealed the decision of the administrative court to the Supreme Administrative Court. In addition, the company requested the Supreme Administrative Court to refer the case to the CJEU for a preliminary ruling on the interpretation of Article 5(3) ePrivacy Directive to clarify whether the provision also applies to web requests. Holding The court dismissed the controller's appeal and stated that there were no grounds to amend the decision of the administrative court. First, the court held that there was no need to refer the case to the CJEU for a preliminary ruling – it considered the interpretation of the ePrivacy Directive to be sufficiently clear. Second, the court came to the same conclusion as the previous instances regarding the placement and use of cookies on the company's websites. The court held that the company had violated Section 205(1) of the Act on Electronic Communications Services, as the use of cookies was not necessary for the company within the meaning of Section 205(2). Moreover, the court interpreted the exception in Section 205(2) narrowly and pointed out that the wording of Article 5(3) ePrivacy Directive indicates that the threshold for applying the exception is intended to be quite high. A different assessment could not be supported by considerations related to freedom of speech or the role of pluralistic and independent media either. Finally, the court held that the company should also have obtained users’ consent for the web requests. A web request of this kind allows the recipient to create a user identifier as well as to gain access to e.g. the user’s IP address, browser information, and cookie data. According to the court, these web requests therefore constitute the gaining of access to information stored in the terminal equipment of a user within the meaning of Article 5(3) ePrivacy Directive. The court argued web requests could not be considered to fall outside the scope of the provision simply because their technical operating principles differ from those of cookies. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. The Supreme Administrative Court had to decide whether a media company that provided news services could be required to make cookies related to the personalized delivery of news content on its websites subject to consent. As a general rule, the storage of cookies or other data describing the use of the service on a user’s device, and the use of such data, required the user’s consent and appropriate notification. The threshold for deviating from the general rule was intended to be high, and no grounds for such a deviation were found in this case. The matter did not warrant a different assessment based on considerations related to freedom of speech or the role of the media. Freedom of speech did not, in and of itself, imply that a news service provider should be permitted to collect and use information pertaining to the private lives of users of its websites. Nor did the imposed obligation interfere with the pluralistic and independent media services guaranteed by law, nor with the free flow of reliable information, nor did the obligation restrict the company’s right to decide what content it publishes and when. Nor did the obligation prevent the provision of journalistic content in a personalized manner based on the user’s consent and the provision of information. The case also raised the question of whether the provision regarding user consent applied not only to cookies but also to certain online invitations. Section 205(1) and (2) and Section 330 of the Act on Electronic Communications Services Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC (Electronic Communications Data Protection Directive), Article 1(1) and Article 5(3) Decision Subject to Appeal Helsinki Administrative Court, October 9, 2024, No. 5845/2024 Decision of the Supreme Administrative Court 1. The Supreme Administrative Court grants Sanoma Media Finland Oy leave to appeal insofar as the matter concerns making personalization and delivery cookies, as well as web beacons, subject to consent, and will examine the case in these respects. The requests for an oral hearing and for a preliminary ruling from the Court of Justice of the European Union are denied. The appeal is dismissed. The final outcome of the Administrative Court’s decision remains unchanged. 2. The application for leave to appeal is dismissed in all other respects. The Supreme Administrative Court therefore does not rule on the appeal in these respects. 3. Sanoma Media Finland Oy’s claim for reimbursement of legal costs is dismissed. Background of the Case In its decision of June 8, 2023, the Finnish Transport and Communications Agency found that Sanoma Media Finland Oy (hereinafter also “Sanoma”) had violated Section 2

Entities