[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIc6L-nIyhZBTwMaHZEDFUNLLuMNLrDVQ0bpmR8epITA":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"d9f839b8-95ef-4949-be90-0463ae7c50b8","KHO - KHO:2026:65","kho-kho-2026-65-5c32c2","← Older revision Revision as of 15:04, 9 September 2026 Line 100: Line 100: }} }} The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed the user to consent in violation of the national implementation of [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj Article 5(3) ePrivacy Directive.] The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed users to consent in violation of the national implementation of [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj Article 5(3) ePrivacy Directive.] == English Summary == == English Summary ==","Finland's Supreme Administrative Court ruled that a media company's cookie banner design made it too difficult to reject non-essential cookies, unduly pushing users towards consent. This design violated the national implementation of Article 5(3) of the ePrivacy Directive, as well as GDPR provisions regarding consent.","Finnish court rules media company's cookie banner violates ePrivacy Directive.","Help KHO - KHO:2026:65: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 13:05, 9 September 2026 view sourceSfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators530 edits Tag: Removed redirect← Older edit Latest revision as of 15:04, 9 September 2026 view source Ls (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators405 editsTag: Visual edit Line 100: Line 100: }}}} The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed the user to consent in violation of the national implementation of [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj Article 5(3) ePrivacy Directive.]The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed users to consent in violation of the national implementation of [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj Article 5(3) ePrivacy Directive.] == English Summary ==== English Summary == Latest revision as of 15:04, 9 September 2026 KHO - KHO:2026:65 Court: KHO (Finland) Jurisdiction: Finland Relevant Law: Article 4(11) GDPR Article 7(3) GDPR Article 5(3) ePrivacy Directive 2002\u002F58\u002FECLaki sähköisen viestinnän palveluista (917\u002F2014) 205 § Decided: 27.08.2026 Published: 27.08.2026 Parties: Otavamedia Oy National Case Number\u002FName: KHO:2026:65 European Case Law Identifier: ECLI:FI:KHO:2026:65 Appeal from: Helsingin HAO (Administrative Court of Helsinki)5.2.2026 nro 638\u002F2026 Appeal to: Not appealed Original Language(s): Finnish Original Source: KHO (in Finnish) Initial Contributor: av The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed users to consent in violation of the national implementation of Article 5(3) ePrivacy Directive. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A media company (the controller) utilised a two-layer banner to request user consent for the use of cookies on the website of a magazine specialised in language owned by the controller (suomenkuvalehti.fi). The first layer of the banner primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the banner for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers. On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it found that accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. As a result, the consent was obtained in violation of Article 4(11) GDPR and Section 205(1) of the Finnish Act on Electronic Communications Services, the national implementation of Article 5(3) ePrivacy Directive. The controller appealed the agency's decision to the Administrative Court of Helsinki. The court dismissed the appeal, confirmed the findings of the Transport and Communications Agency and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of Articles 4(11) and 7(3) GDPR. Holding The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of Articles 4(11) and 7(3) GDPR to be sufficiently clear. Second, the court held that the cookie banner at issue violated Section 205(1) of the Act on Electronic Communications Services, as the consent given by the user could not be considered freely given. The court interpreted Section 205 of the Communications Services Act in light of EU law and CJEU jurisprudence. In particular, the court referred to the CJEU’s decisions in the cases C-673\u002F17 Planet49 and and C-61\u002F19 Orange România. In Planet49, the CJEU emphasised that consent requires active behaviour by the user in order to be freely given.[1] In Orange România, the controller had unduly influenced the data subject’s freedom to object to the processing of their data by requiring the data subject to fill out an additional form to withdraw their consent.[2] The court argued that accepting all cookies was remarkably simple and quick, and users were guided towards this choice. In contrast, the option to withhold consent was not explicitly presented right away, and opting out of non-essential cookies was significantly slower and more cumbersome for the user. Thus, the cookie banner had unduly influenced the user’s freedom to choose not to give consent. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. The Supreme Administrative Court had to decide whether a website’s cookie policy was unlawful on the grounds that the consent given by the user on the site could not be considered to have been given voluntarily. The website’s consent management mechanism was designed so that giving consent at the first level of the mechanism was remarkably simple and quick. Users were also guided toward this choice. In contrast, the option to withhold consent was not explicitly presented immediately, and making this choice was significantly slower and more cumbersome for the user. The consent management mechanism had inappropriately influenced the user’s freedom of choice not to grant consent, and granting consent was therefore not based on a genuine opportunity for free choice. The cookie policy was unlawful. Section 205(1) and (2) and Section 330 of the Act on Electronic Communications Services Directive 2002\u002F58\u002FEC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector (Electronic Communications Privacy Directive), as amended by Directive 2009\u002F136\u002FEC, Article 1(1), Article 2, second paragraph, point (f), and Article 5(3) Regulation (EU) 2016\u002F679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation), Article 4(11) and Article 7(4) Decision subject to appeal Helsinki Administrative Court, February 5, 2026, No. 638\u002F2026 Decision of the Supreme Administrative Court The Supreme Administrative Court grants Otavamedia Oy leave to appeal and will review the case. The request for a preliminary ruling from the Court of Justice of the European Union is denied. The appeal is dismissed. The final outcome of the Administrative Court’s decision is not altered. Otavamedia Oy’s request for reimbursement of legal costs is denied. Background In its decision of April 26, 2024, the Finnish Transport and Communications Agency found that the cookie policies on Otavamedia Oy’s suomenkuvalehti.fiwebsit","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=KHO_-_KHO:2026:65&diff=52992&oldid=52990","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-09T15:04:10+00:00","2026-09-09T16:00:12.278925+00:00",7,[18],{"name":19,"type":20},"Otavamedia Oy","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,32,37,42],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":33},{"id":34,"icon":23,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":23,"name":40,"slug":41},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":43},{"id":21,"icon":23,"name":24,"slug":25},[]]