KHO - KHO:2026:64

Summary

The Supreme Administrative Court of Finland has ruled that a media company violated the ePrivacy Directive by failing to obtain user consent for cookies and web requests on its websites. The court upheld a decision by the Finnish Transport and Communications Agency, stating that these actions were not necessary and thus required explicit consent. The court also clarified that the ePrivacy Directive's provisions apply to web requests, not just cookies, and found no need to refer the case to the CJEU for further interpretation.

Full text

Help KHO - KHO:2026:64: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 11:57, 1 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators155 edits Tag: Decisions [1.0] Revision as of 12:38, 1 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators155 edits Tag: Visual editNewer edit → Line 92: Line 92: }}}} The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive 2002/58/EC by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites.The Supreme Administrative Court held that a media company had violated the national provision implementing [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive 2002/58/EC] by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites. == English Summary ==== English Summary == === Facts ====== Facts === A media company that provides news services did not request user context for the placement and use of cookies or certain web requests on several websites it managed. In June 2023, the Finnish Transport and Communications Agency issued a decision where it found that the company had violated Section 205(1) of the Finnish Act on Electronic Communications Services, a provision implementing Article 5(3) of the ePrivacy Directive 2002/58/EC. The agency held that consent was required for both the cookies and the web requests, as these were not necessary within the meaning of the infringed provision. A media company that provides news services did not request user context for the placement and use of cookies or certain web requests on several websites it managed. In June 2023, the Finnish Transport and Communications Agency issued a decision where it found that the company had violated [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Finnish Act on Electronic Communications Services (917/2014)], a provision implementing [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) of the ePrivacy Directive 2002/58/EC]. The agency held that consent was required for both the cookies and the web requests, as these were not necessary within the meaning of the infringed provision. The company appealed the decision of the agency to an administrative court, which dismissed the appeal. Following this, the company appealed the decision of the administrative court to the Supreme Administrative Court. In addition, the company requested the Supreme Administrative Court to refer the case to the CJEU for a preliminary ruling on the interpretation of Article 5(3) ePrivacy Directive to clarify whether the provision also applies to web requests. The company appealed the decision of the agency to an administrative court, which dismissed the appeal. Following this, the company appealed the decision of the administrative court to the Supreme Administrative Court. In addition, the company requested the Supreme Administrative Court to refer the case to the CJEU for a preliminary ruling on the interpretation of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive] to clarify whether the provision also applies to web requests. === Holding ====== Holding === The court dismissed the controller's appeal and stated that there were no grounds to amend the decision of the administrative court. First, the court held that there was no need to refer the case to the CJEU for a preliminary ruling – it considered the interpretation of the ePrivacy Directive to be sufficiently clear. The court dismissed the controller's appeal and stated that there were no grounds to amend the decision of the administrative court. First, the court held that there was no need to refer the case to the CJEU for a preliminary ruling – it considered the interpretation of the ePrivacy Directive to be sufficiently clear. Second, the court came to the same conclusion as the previous instances regarding the placement and use of cookies on the company's websites. The court held that the company had violated Section 205(1) of the Act on Electronic Communications Services, as the use of cookies was not necessary for the company within the meaning of Section 205(2). Moreover, the court interpreted the exception in Section 205(2) narrowly and pointed out that the wording of Article 5(3) ePrivacy Directive indicates that the threshold for applying the exception is intended to be quite high. The matter did not require a different assessment due to considerations related to freedom of speech or the role of pluralistic and independent media.Second, the court came to the same conclusion as the previous instances regarding the placement and use of cookies on the company's websites. The court held that the company had violated [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Act on Electronic Communications Services], as the use of cookies was not necessary for the company within the meaning of [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(2)]. Moreover, the court interpreted the exception in [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(2)] narrowly and pointed out that the wording of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive] indicates that the threshold for applying the exception is intended to be quite high. A different assessment could not be supported by considerations related to freedom of speech or the role of pluralistic and independent media either. Finally, the court held that the company should also have obtained users’ consent for the web requests. A web request allows the recipient to create a user identifier as well as to gain access to e.g. the user’s IP address, browser information, and cookie data. According to the court, web requests therefore constitute the gaining of access to information stored in the terminal equipment of a user within the meaning of Article 5(3) ePrivacy Directive. The court argued web requests could not be considered to fall outside the scope of the provision simply because their technical operating principles differ from those of cookies.Finally, the court held that the company should also have obtained users’ consent for the web requests. A web request of this kind allows the recipient to create a user identifier as well as to gain access to e.g. the user’s IP address, browser information, and cookie data. According to the court, these web requests therefore constitute the gaining of access to information stored in the terminal equipment of a user within the meaning of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive]. The court argued web requests could not be considered to fall outside the scope of the provision simply because their technical operating principles differ from those of cookies. == Comment ==== Comment == Revision as of 12:38, 1 September 2026 KHO - KHO:2026:64 Court: KHO (Finland) Jurisdiction: Finland Relevant Law: Article 5(3) ePrivacy Directive 2002/58/ECLaki sähköisen viestinnän palveluista 205 § Decided: 27.08.2026 Published: 27.08.2026 Parties: Sanoma Media Finland Oy National Case Number/Name: KHO:2026:64 European Case Law Identifier: ECLI:FI:KHO:2026:64 Appeal from: Helsingin HAO (Administrative Court of Helsinki)9.10.2024 nro 5845/2024 Appeal to: Not appealed Original Language(s): Finnish Original Source: KHO (in Finnish) Initial Contributor: av The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive 2002/58/EC by failing to obtain users’ consent for the storage and use of cookies and web requests on its websites. Conten

Entities