KHO - KHO:2026:65
Finnish court rules media company's cookie banner violates ePrivacy Directive.
Finland's Supreme Administrative Court ruled that a media company's cookie banner design made it too difficult to reject non-essential cookies, unduly pushing users towards consent. This design violated the national implementation of Article 5(3) of the ePrivacy Directive, as well as GDPR provisions regarding consent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Otavamedia Oy?
Get an email when a new story names Otavamedia Oy, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Finnish media company's cookie banner was designed in a way that made rejecting non-essential cookies unnecessarily difficult, effectively nudging users toward consent rather than offering a genuine, freely-given choice. Finland's Supreme Administrative Court found this practice violated Article 5(3) of the ePrivacy Directive and GDPR consent requirements, which mandate that consent be as easy to withdraw or deny as it is to give. This is a textbook example of a 'dark pattern' — a design choice that technically appears compliant while undermining user autonomy. The ruling underscores that compliance is not just about having a consent mechanism, but ensuring it is fair, balanced, and transparent. Organizations that rely on consent as a legal basis for data processing must treat UI/UX design decisions as regulatory decisions.