KHO - KHO:2026:65

Summary

Finland's Supreme Administrative Court has ruled that a media company violated the ePrivacy Directive by using a cookie consent banner that made it significantly more difficult to reject non-essential cookies than to accept them. The court upheld a decision by the Finnish Transport and Communications Agency, finding that the consent obtained was not freely given, as required by GDPR and the ePrivacy Directive.

Full text

Help KHO - KHO:2026:65: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 09:06, 2 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators166 edits Tag: Visual edit← Older edit Revision as of 08:44, 8 September 2026 view source Ls (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators390 editsmTag: Visual editNewer edit → Line 100: Line 100: }}}} The Supreme Administrative Court held that a media company had violated the national provision implementing [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive.] Consent given to the use of cookies on its website was not freely given, as rejecting non-essential cookies was significantly more difficult than accepting all cookies.The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed the user to consent, in violation of the national implementation of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive.] == English Summary ==== English Summary == === Facts ====== Facts === A media company (the controller) utilised a two-layer mechanism to request user consent for the use of cookies on the website of a language news magazine owned by the controller ([https://suomenkuvalehti.fi/ suomenkuvalehti.fi]). The first layer of the mechanism primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the mechanism for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers.A media company (the controller) utilised a two-layer banner to request user consent for the use of cookies on the website of a language news magazine owned by the controller ([https://suomenkuvalehti.fi/ suomenkuvalehti.fi]). The first layer of the banner primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the banner for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers. On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it held that the consent obtained in this manner could not be considered freely given as required by [[Article 4 GDPR|Article 4(11) GDPR]] and [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive]. The Agency found that the controller's cookie policy violated [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Finnish Act on Electronic Communications Services], as accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button.A data subject filed a complaint against the controller on '''XXXX (date).''' On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it found that accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. As a result, the consent was obtained in violation of [[Article 4 GDPR|Article 4(11) GDPR]] and [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Finnish Act on Electronic Communications Services], the national implementation of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive]. '''(Comment LS: I rephrased this a bit, please change if section 205(1) is not the implementation of 5(3) eprivacy)''' The controller appealed the agency's decision to the Administrative Court of Helsinki. The court of first instance dismissed the appeal and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]].The controller appealed the agency's decision to the Administrative Court of Helsinki. The court of first instance dismissed the appeal and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]]. === Holding ====== Holding === The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]] to be sufficiently clear. The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]] to be sufficiently clear. Revision as of 08:44, 8 September 2026 KHO - KHO:2026:65 Court: KHO (Finland) Jurisdiction: Finland Relevant Law: Article 4(11) GDPR Article 7(3) GDPR Article 5(3) ePrivacy Directive 2002/58/ECLaki sähköisen viestinnän palveluista (917/2014) 205 § Decided: 27.08.2026 Published: 27.08.2026 Parties: Otavamedia Oy National Case Number/Name: KHO:2026:65 European Case Law Identifier: ECLI:FI:KHO:2026:65 Appeal from: Helsingin HAO (Administrative Court of Helsinki)5.2.2026 nro 638/2026 Appeal to: Not appealed Original Language(s): Finnish Original Source: KHO (in Finnish) Initial Contributor: av The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed the user to consent, in violation of the national implementation of Article 5(3) ePrivacy Directive. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A media company (the controller) utilised a two-layer banner to request user consent for the use of cookies on the website of a language news magazine owned by the controller (suomenkuvalehti.fi). The first layer of the banner primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the banner for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was high

Entities