[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIAi-gskz3kFVvrqSu469XoSjXFt6UJ9tohTo7gzpE3A":3},{"article":4,"iocs":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"23ac742a-3959-4197-b069-1cfdcc7ce7f7","KHO - KHO:2026:65","kho-kho-2026-65-7a9c64","Created page with \"{{COURTdecisionBOX |Jurisdiction=Finland |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=KHO |Court_Original_Name=Korkein hallinto-oikeus |Court_English_Name=The Supreme Ad­min­is­tra­tive Court of Finland |Court_With_Country=KHO (Finland) |Case_Number_Name=KHO:2026:65 |ECLI=ECLI:FI:KHO:2026:65 |Original_Source_Name_1=KHO |Original_Source_Link_1=https:\u002F\u002Fwww.kho.fi\u002Fpaatokset\u002Fkho202665\u002F |Original_Source_Language_1=Finnish |Original_Source_Language__...\" New page {{COURTdecisionBOX |Jurisdiction=Finland |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=KHO |Court_Original_Name=Korkein hallinto-oikeus |Court_English_Name=The Supreme Ad­min­is­tra­tive Court of Finland |Court_With_Country=KHO (Finland) |Case_Number_Name=KHO:2026:65 |ECLI=ECLI:FI:KHO:2026:65 |Original_Source_Name_1=KHO |Original_Source_Link_1=https:\u002F\u002Fwww.kho.fi\u002Fpaatokset\u002Fkho202665\u002F |Original_Source_Language_1=Finnish |Original_Source_Language__Code_1=FI |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Date_Started= |Date_Decided=27.08.2026 |Date_Published=27.08.2026 |Year=2026 |GDPR_Article_1=Article 4(11) GDPR |GDPR_Article_Link_1=Article 4 GDPR#11 |GDPR_Article_2=Article 7(3) GDPR |GDPR_Article_Link_2=Article 7 GDPR#3 |GDPR_Article_3= |GDPR_Article_Link_3= |GDPR_Article_4= |GDPR_Article_Link_4= |EU_Law_Name_1=Article 5(3) ePrivacy Directive 2002\u002F58\u002FEC |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj |EU_Law_Name_2= |EU_Law_Link_2= |EU_Law_Name_3= |EU_Law_Link_3= |National_Law_Name_1=Laki sähköisen viestinnän palveluista (917\u002F2014) 205 § |National_Law_Link_1=https:\u002F\u002Fwww.finlex.fi\u002Ffi\u002Flainsaadanto\u002F2014\u002F917 |National_Law_Name_2= |National_Law_Link_2= |National_Law_Name_3= |National_Law_Link_3= |Party_Name_1=Otavamedia Oy |Party_Link_1=https:\u002F\u002Fotavamedia.fi\u002F |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_From_Body=Helsingin HAO (Administrative Court of Helsinki) |Appeal_From_Case_Number_Name=5.2.2026 nro 638\u002F2026 |Appeal_From_Status= |Appeal_From_Link= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Not appealed |Appeal_To_Link= |Initial_Contributor=av | }} The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive. Consent given to the use of cookies on its website was not freely given, as rejecting non-essential cookies was significantly more difficult than accepting all cookies. == English Summary == === Facts === A media company (the controller) employed a two-layer mechanism to request user consent for the use of cookies on the website of a language news magazine owned by the controller. The first layer of the mechanism primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the mechanism for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers. On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it held that the consent obtained in this manner could not be considered freely given as required by [[Article 4 GDPR|Article 4(11) GDPR]] and Article 5(3) ePrivacy Directive. The Agency found that the controller's cookie policy violated Section 205(1) of the Finnish Act on Electronic Communications Services, as accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. The controller appealed the agency's decision to the Administrative Court of Helsinki. The court of first instance dismissed the appeal and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of Articles 4(11) and 7(3) GDPR. === Holding === The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of Articles 4(11) and 7(3) GDPR to be sufficiently clear. Second, the court held that the cookie policy at issue violated Section 205(1) of the Act on Electronic Communications Services, as the consent given by the user could not be considered freely given. The court interpreted Section 205 of the Communications Services Act in light of EU law and CJEU jurisprudence. In particular, the court referred to the CJEU’s decisions in the cases C-673\u002F17 Planet49 and and C-61\u002F19 Orange România. In Planet49, the CJEU emphasised that consent requires active behaviour by the user in order to be freely given.1 In Orange România, the controller had unduly influenced the data subject’s freedom to object to the processing of their data by requiring the data subject to fill out an additional form to withdraw their consent.2 The court argued that accepting all cookies was remarkably simple and quick, and users were guided towards this choice. In contrast, the option to withhold consent was not explicitly presented right away, and opting out of non-essential cookies was significantly slower and more cumbersome for the user. Thus, the consent management mechanism had unduly influenced the user’s freedom to choose not to give consent. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. The Supreme Administrative Court had to decide whether a website’s cookie policy was unlawful on the grounds that the consent given by the user on the site could not be considered to have been given voluntarily. The website’s consent management mechanism was designed so that giving consent at the first level of the mechanism was remarkably simple and quick. Users were also guided toward this choice. In contrast, the option to withhold consent was not explicitly presented immediately, and making this choice was significantly slower and more cumbersome for the user. The consent management mechanism had inappropriately influenced the user’s freedom of choice not to grant consent, and granting consent was therefore not based on a genuine opportunity for free choice. The cookie policy was unlawful. Section 205(1) and (2) and Section 330 of the Act on Electronic Communications Services Directive 2002\u002F58\u002FEC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector (Electronic Communications Privacy Directive), as amended by Directive 2009\u002F136\u002FEC, Article 1(1), Article 2, second paragraph, point (f), and Article 5(3) Regulation (EU) 2016\u002F679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation), Article 4(11) and Article 7(4) Decision subject to appeal Helsinki Administrative Court, February 5, 2026, No. 638\u002F2026 Decision of the Supreme Administrative Court The Supreme Administrative Court grants Otavamedia Oy leave to appeal and will review the case. The request for a preliminary ruling from the Court of Justice of the European Union is denied. The appeal is dismissed. The final outcome of the Administrative Court’s decision is not altered. Otavamedia Oy’s request for reimbursement of legal costs is denied. Background In its decision of April 26, 2024, the Finnish Transport and Communications Agency found that the cookie policies on Otavamedia Oy’s suomenkuvalehti.fiwebsite’s cookie policies violate Section 205(1) of the Act on Electronic Communications Services (the Communications Services Act), Section 205(1), among other things, in that accepting all cookies is easier in the website’s consent management mechanism than refusing them, in a manner which also fails to meet the requirements for consent set forth in the General Data Protection Regulation. In this regard, the decision refers, among other things, to the fact that accepting all cookies was possible at the first level of the mechanism, where the relevant option was highlighted in green, whereas opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. This differential treatment of options has had a significant impact on user behavior, and the procedure is very likely intended to steer users toward accepting the use of all cookies. Pursuant to Section 330(1) of the Communications Services Act, the Finnish Transport and Communications Agency has required the company to modify its consent management mechanism so that users are given the option, in addition to accepting all cookies, to refuse the use of non-essential cookies at the first level of the mechanism. The Administrative Court has, insofar as the matter is before the Supreme Administrative Court, dismissed Otavamedia Oy’s appeal as well as its requests for a preliminary ruling from the Court of Justice of the European Union and for reimbursement of litigation costs. The Administrative Court has found that the General Data Protection Regulation sets quite high requirements for consent, including, among other things, the requirement that the user be able to make a voluntary choice. The Administrative Court has interpreted the concept of voluntariness to mean that, in order for a user’s consent to be considered voluntary, in addition to providing the user with understandable and comprehensive information, there must be an alternative to giving consent, and choosing that alternative must not be made more difficult than giving consent. The Administrative Court has found that, in Otavamedia Oy’s consent management tool, refusing cookies has been made more cumbersome than consenting to their use, as refusing cookies requires at least two clicks, whereas consent can be given with a single click. In light of this, the granting of consent cannot be considered to have been given entirely voluntarily, and the consent management mechanism is unlawful. The case was decided by Administrative Court Justices Esa Hakkola, Liisa Selvenius-Hurme—who also presented the case—and Joonas Ahtonen. Claims Before the Supreme Administrative Court Otavamedia Oy has requested leave to appeal and demanded that the decisions of the Administrative Court and the Finnish Transport and Communications Agency be overturned. The company has also requested that the Supreme Administrative Court seek a preliminary ruling from the Court of Justice of the European Union. The Finnish Transport and Communications Agency must also be ordered to reimburse the company’s legal costs, including interest for delay. The Finnish Transport and Communications Agency has argued that the company’s appeal, as well as its requests for a preliminary ruling and reimbursement of legal costs, should be dismissed. Reasons for the Supreme Administrative Court’s Decision Claim Regarding the Request for a Preliminary Ruling Key Arguments of the Parties Otavamedia Oy has argued that the Supreme Administrative Court should request a preliminary ruling from the Court of Justice of the European Union regarding the interpretation of Article 4(11) and Article 7(3) of the General Data Protection Regulation. According to the company, the Administrative Court has adopted a novel interpretation, and the relationship between the aforementioned provisions is unclear. A preliminary ruling must be sought on whether, under those provisions, users must be offered the option to refuse the use of all non-essential cookies through exactly the same action used to accept them, and whether the voluntary nature of consent that refusing to give consent must be just as easy as giving consent. The facts of the Court of Justice’s previous judgments differ significantly from those of the present case, and the Court has not examined the voluntary nature of consent in light ofRegulation. Furthermore, the case involves a balancing of interests between, on the one hand, the right to privacy and, on the other hand, the freedom to conduct a business and freedom of expression. The Finnish Transport and Communications Agency has argued that it is not necessary to request a preliminary ruling on the questions raised by the company. Legal Assessment and Conclusion Under Article 267 of the Treaty on the Functioning of the European Union, the Court of Justice of the European Union has jurisdiction to give preliminary rulings, among other things, on the interpretation of the Treaties and of acts of the institutions of the Union. If such a question arises in a case pending before a national court against whose decisions no further appeal is permitted under national law, that court must refer the question to the Court of Justice of the European Union. In Finland, the Supreme Administrative Court exercises the highest judicial authority in administrative law matters. It follows from the case law of the Court of Justice of the European Union that there is no obligation to make a request for a preliminary ruling under Article 267 of the Treaty on the Functioning of the European Union, however, if the national court has no genuine doubt as to the applicability of existing case law of the Court of Justice of the European Union to the case, or if it is entirely clear how Union law is to be properly applied in the situation at hand. Taking into account the case law of the Court of Justice referred to below in this decision, as well as the grounds on which the Supreme Administrative Court has decided the case, there is no reasonable doubt as to the interpretation of Union law relevant to the resolution of the case. Consequently, no question concerning Union law has arisen in this case that would necessitate the submission of a request for a preliminary ruling under Article 267 of the Treaty on the Functioning of the European Union. The Main Issue The Issue The central issue in this case is whether the cookie policy of the suomenkuvalehti.fiwebsite’s cookie policy unlawful on the grounds that the consent given by the user on the site cannot be considered to have been given voluntarily. Based on the Finnish Transport and Communications Agency’s decision, the website has employed a two-tier consent management mechanism to request user consent. The first level of the mechanism mainly consisted of brief general information about the use of cookies and certain other data, as well as “Accept All” and “Settings” buttons. The first button was highlighted with a green background, and by clicking it, the user could proceed to the website’s main content while accepting all cookies. Clicking the “Settings” button opened the second level of the mechanism for the user. This second level included, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, and the buttons “Block All,” “Accept Selected,” and “Accept All.” The latter button was highlighted with a green background. At this level, the user could make more specific choices, block the use of all cookies other than those defined as necessary, or accept cookies. Key Arguments of the Parties According to Otavamedia Oy, the voluntary nature of consent does not require that choices be made at a single level within the consent management mechanism. A two-tier mechanism ensures that the user can make informed and differentiated choices between different purposes of use. The user must make an active choice already at the first tier of the mechanism. This is a matter of voluntary and genuine freedom of choice. Expressing refusal with two clicks instead of one does not mean that consent was not given voluntarily. The assessment of whether consent was given voluntarily cannot be based on the technical implementation of the mechanism alone, rather than on a comprehensive evaluation. Other elements of consent, such as the requirements of awareness and specificity, must also be taken into account. A multi-level mechanism enables the provision of accurate, complete, and understandable information. Legislation, case law, or guidelines on consent do not require the strict interpretation adopted by the Administrative Court. According to the company, its consent management mechanism is largely based on the European standard used by media industry players (the IAB Europe TCF standard). The use of cookies has a significant impact on the ability of domestic news service providers to operate and, consequently, on freedom of speech and the dissemination of information, as advertising revenue is vital to the industry. Domestic media should not be subject to requirements that are substantially stricter than those applied to other content services. It must be assessed whether the decisions made constitute a disproportionate interference with the company’s freedom of enterprise. The Finnish Transport and Communications Agency has referred to the grounds presented in its decision. According to the Agency, consent cannot be considered to have been given voluntarily when refusing consent is more difficult and time-consuming than granting it. The issue here is not that a two-tier consent management mechanism should not be used at all. The issue is that users must be given the opportunity to make voluntary and individualized choices regarding the use of cookies. The Finnish Transport and Communications Agency has proposed that, at the first level of the mechanism, users be given the option to accept all cookies without reading the more detailed information presented at the second level. Users are not offered a corresponding option to block the use of all optional cookies, nor are they informed of the possibility to refuse the use of cookies other than those that are strictly necessary. Applicable and Other Relevant Legal Provisions According to Section 205(1) of the Act on Electronic Communications Services (the Electronic Communications Services Act), Section 205(1), the storage of cookies or other data describing the use of the service on the user’s terminal device and the use of such data are permitted for the service provider, provided that the user has given their consent and the service provider provides the user with understandable and comprehensive information regarding the purpose of such storage or use. According to paragraph 2 of the same section, the provisions of paragraph 1 do not apply to the storage or use of data whose sole purpose is to facilitate the transmission of a message over communications networks or which is necessary for the service provider to provide a service that the subscriber or service user has expressly requested. According to paragraph 3 of the section, the storage and use referred to in the section are permitted only to the extent required by the service and must not restrict the protection of privacy more than is necessary. Pursuant to Section 330(1) of the Communications Services Act, among other things, the Finnish Transport and Communications Agency may, in carrying out its duties under said Act, issue a warning to any party anyone who violates the Act or the regulations, orders, decisions, and license conditions issued pursuant to it, and require that person to correct their error or omission within a reasonable time. Directive 2002\u002F58\u002FEC of the European Parliament and of the Council on the processing of personal data and the protection of privacy in the electronic communications sector (the ePrivacy Directive), as amended by Directive 2009\u002F136\u002FEC, Article 1(1) provides that the Directive aims to harmonize the national provisions necessary to ensure an equivalent level of protection of fundamental rights and freedoms, in particular the right to privacy and confidentiality, in the processing of personal data in the electronic communications sector, and to ensure the free movement of such data and of electronic communications equipment and services within the Community. Pursuant to Article 5(3) of the amended Directive, Member States shall ensure that the retention of data or the use of data stored on a subscriber’s or user’s terminal equipment is permitted only on the condition the subscriber or user in question has given his or her consent after having been provided with clear and comprehensive information, inter alia, regarding the purpose of the processing in accordance with Directive 95\u002F46\u002FEC. This does not preclude technical storage or use, whose sole purpose is to carry out the transmission of communications over electronic communications networks or which is strictly necessary for the provider of an information society service to provide a service which the subscriber or user has specifically requested. According to Article 2(2)(f) of the Directive, “consent” by a user or subscriber within the meaning of the Directive has the same meaning as “consent” by a data subject within the meaning of Directive 95\u002F46\u002FEC. According to Recital 17 of the Directive, “consent” of the user or subscriber in that Directive should, regardless of whether the user or subscriber is a natural or legal person, mean the same as the consent of the data subject as defined and specified in Directive 95\u002F46\u002FEC. Consent may be given by any appropriate means that allows for a freely given, specific, and informed indication of the user’s wishes, including checking a box when visiting a website. Regulation (EU) 2016\u002F679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (EU) 2016\u002F679 (General Data Protection Regulation), Article 94(2) provides that references to Directive 95\u002F46\u002FEC, as repealed by the Regulation, shall be construed as references to that Regulation. According to Article 4(11) of the Regulation, “consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of his or her personal data. Article 7 of the Regulation sets forth the conditions for consent. According to paragraph 4 of that article, when assessing the voluntary nature of consent, due consideration must be given, to the greatest extent possible, to, among other things, whether consent to the processing of personal data that is not necessary for the performance of a contract, including the provision of a service, is made a condition for the performance of the contract, including the provision of the service, According to Recital 32 of the Regulation, consent should be given by a clear affirmative act, such as a written, including electronic, or an oral statement that indicates the data subject’s voluntary, specific, informed, and unambiguous expression of will to consent to the processing of their personal data. Such an act could, for example, consist of the data subject checking a box when visiting a website, selects technical settings for information society services, or makes any other statement or takes an action that clearly indicates, in this context, that they consent to the proposed processing of their personal data. Consent should therefore not be implied by silence, by pre-checked boxes, or by failing to take a specific action. Consent should cover all processing operations carried out for the same purpose or purposes. If the processing has multiple purposes, consent should be given for all processing purposes. If the data subject is to give consent in response to an electronic request, the request must be clear and concise and must not unduly interfere with the use of the service for which it is given. Recital 42 states, among other things, that consent cannot be considered freely given if the data subject does not have a genuine choice and cannot subsequently refuse to give consent or withdraw it without suffering any disadvantage. None of the language versions of the Regulation contain an expression corresponding to the Finnish word “later.” Legal Assessment and Conclusion Under the general rule set forth in Section 205,Paragraph 1 establishes the general rule that the storage of cookies or other data describing the use of the service on the user’s device, as well as the use of such data, requires the user’s consent and appropriate information. Paragraph 2 of the section provides for exceptions to this rule, including, among other things, the storage and use of data deemed necessary under the provision. Section 205 of the Communications Services Act implements Article 5(3) of the ePrivacy Directive. The user’s consent referred to in the Directive may, as stated in the preamble, be given by any appropriate means that allows for a freely given, specific, and informed indication of the user’s wishes. In the Directive, “user consent” has the same meaning as “data subject consent” in the current General Data Protection Regulation. The General Data Protection Regulation sets forth several qualitative requirements for the data subject’s consent. Under the Regulation, consent must be, among other things, a voluntary, specific, informed, and unambiguous expression of will by which the data subject consents to the processing of their personal data. According to the judgment of the Court of Justice of the European Union in Case C-673\u002F17, Planet49, consent as referred to in the ePrivacy Directive must be based on active action by the user (paragraph 56). The judgment in Case C-61\u002F19, Orange România, addressed the requirements regarding consent under the General Data Protection Regulation. In that judgment, a contract containing a consent clause was not considered to demonstrate that consent had been given voluntarily. In that case, the data controller had unduly influenced the data subject’s freedom to object to the processing of their data by requiring the data subject to fill out an additional form in order to withdraw their consent (paragraphs 50 and 52). The user’s consent referred to in Section 205 of the Communications Services Act must be assessed in light of the requirements for consent under Union law. It can be inferred from the case law cited above that, with regard to the requirement that consent be given freely, various practical measures, among other things, may be relevant, that may affect a person’s ability to exercise their freedom of choice. The preamble to the General Data Protection Regulation also emphasizes the possibility of genuine freedom of choice and the ability to withdraw consent without detriment. In practice, users must make choices regarding cookie consent on a large number of websites. In this context, even a relatively minor additional effort involved in refusing consent, compared to granting it, can in fact influence a user’s choices and lead them to grant their consent, even if they would otherwise be opposed to the processing of their data. This effect can be expected to be all the more pronounced the simpler and faster the process of granting consent is made. In the present case, the website has been using the two-tier consent management mechanism described in more detail above. From the first level of the mechanism, users could proceed directly to the website’s main content simply by giving their consent—that is, by accepting all cookies. The button for this action was also highlighted with a background color that clearly distinguished it from the rest of the content on the first level. By contrast, it was not possible to refuse consent at the first level of the mechanism. Furthermore, the first level did not explicitly indicate how users could opt out of non-essential cookies or whether the site could be used if cookies were declined. The option to opt out has only appeared when the user has clicked the settings button to proceed to the second level of the mechanism. At this level, opting out required the user to locate the “Block All” button among the extensive and detailed information content on that level. The button was not clearly distinguishable from the rest of the information on that level. In contrast, the button for giving consent was highlighted with a clearly distinguishable background color even at this level. The consent management mechanism has thus been implemented in such a way that giving consent has been remarkably simple and quick. The user was also guided toward this choice by the color scheme of the buttons. By contrast, the option to withhold consent was not explicitly presented immediately, and making that choice has also been significantly slower and more cumbersome for the user, due in particular to the structure of the mechanism, the need to search for information among other content, and the highlighting of the buttons used to make selections. The aforementioned differences between granting and withholding consent cannot be explained by the company’s reference to the need to provide the user with sufficient and appropriately specified information. Under these circumstances and after evaluating the matter as a whole, the Supreme Administrativeconsiders that the consent management mechanism has unduly influenced the user’s freedom of choice not to grant consent, and that the granting of consent was therefore not based on a genuine opportunity for free choice. Since the consent given through this mechanism cannot, therefore, be considered consent based on a voluntary expression of will in accordance with Section 205 of the Communications Services Act, the website’s cookie policy has been in violation of the aforementioned provision. This conclusion is not altered by the fact that, according to the company, its consent management mechanism complies with a widely adopted European standard. Compliance with the standard does not demonstrate that the company acted in accordance with the Electronic Communications Act and other provisions governing the use of cookies. Nor can it otherwise be established in this case that, due to the standard, the company could have implemented the mechanism in practice only in the manner described above. The Finnish Transport and Communications Agency’s decision was based on regulations binding on the company, the purpose of which is, among other things, to ensure the protection of users’ privacy in the field of electronic communications. The decision has restricted the implementation of the consent management mechanism on the company’s website in a manner that has unduly affected the user’s freedom of choice not to give consent. The decision has not unjustifiably restricted the company’s freedom of enterprise or interfered with the dissemination of information protected by freedom of speech. Based on the foregoing, the Finnish Transport and Communications Agency was authorized under Section 330 of the Communications Services Act to require the company to modify its consent management mechanism. The imposed obligation can be considered to remedy the unlawful practice referred to in the decision, and no alternative methods for remedying the practice have been brought before the Agency for evaluation based on the company’s arguments. For this reason, and taking into account the arguments presented before the Supreme Administrative Court and the evidence obtained in the case, there are no grounds for altering the outcome of the Administrative Court’s decision. Legal Costs With the case thus concluded, and taking into account Section 95 of the Act on Proceedings in Administrative Matters, Otavamedia Oy shall not be ordered to pay compensation for legal costs incurred before the Supreme Administrative Court or the Administrative Court. The case was decided by Justices Outi Suviranta, Taina Pyysaari, Monica Gullans, Toni Kaarresalo, and Päivi Pietarinen. The case was presented by Elina Ranz.","Finland's Supreme Administrative Court ruled that a media company's cookie consent mechanism was unlawful. The court found that the process for rejecting non-essential cookies was significantly more difficult than accepting them, thus violating the ePrivacy Directive and GDPR's requirement for freely given consent. The court dismissed the company's appeal and request for a preliminary ruling from the CJEU.","Finnish court rules media company's cookie consent mechanism violates privacy laws.","Help KHO - KHO:2026:65: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 08:27, 2 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators158 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 08:27, 2 September 2026 KHO - KHO:2026:65 Court: KHO (Finland) Jurisdiction: Finland Relevant Law: Article 4(11) GDPR Article 7(3) GDPR Article 5(3) ePrivacy Directive 2002\u002F58\u002FECLaki sähköisen viestinnän palveluista (917\u002F2014) 205 § Decided: 27.08.2026 Published: 27.08.2026 Parties: Otavamedia Oy National Case Number\u002FName: KHO:2026:65 European Case Law Identifier: ECLI:FI:KHO:2026:65 Appeal from: Helsingin HAO (Administrative Court of Helsinki)5.2.2026 nro 638\u002F2026 Appeal to: Not appealed Original Language(s): Finnish Original Source: KHO (in Finnish) Initial Contributor: av The Supreme Administrative Court held that a media company had violated the national provision implementing Article 5(3) ePrivacy Directive. Consent given to the use of cookies on its website was not freely given, as rejecting non-essential cookies was significantly more difficult than accepting all cookies. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A media company (the controller) employed a two-layer mechanism to request user consent for the use of cookies on the website of a language news magazine owned by the controller. The first layer of the mechanism primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the mechanism for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers. On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it held that the consent obtained in this manner could not be considered freely given as required by Article 4(11) GDPR and Article 5(3) ePrivacy Directive. The Agency found that the controller's cookie policy violated Section 205(1) of the Finnish Act on Electronic Communications Services, as accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. The controller appealed the agency's decision to the Administrative Court of Helsinki. The court of first instance dismissed the appeal and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of Articles 4(11) and 7(3) GDPR. Holding The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of Articles 4(11) and 7(3) GDPR to be sufficiently clear. Second, the court held that the cookie policy at issue violated Section 205(1) of the Act on Electronic Communications Services, as the consent given by the user could not be considered freely given. The court interpreted Section 205 of the Communications Services Act in light of EU law and CJEU jurisprudence. In particular, the court referred to the CJEU’s decisions in the cases C-673\u002F17 Planet49 and and C-61\u002F19 Orange România. In Planet49, the CJEU emphasised that consent requires active behaviour by the user in order to be freely given.1 In Orange România, the controller had unduly influenced the data subject’s freedom to object to the processing of their data by requiring the data subject to fill out an additional form to withdraw their consent.2 The court argued that accepting all cookies was remarkably simple and quick, and users were guided towards this choice. In contrast, the option to withhold consent was not explicitly presented right away, and opting out of non-essential cookies was significantly slower and more cumbersome for the user. Thus, the consent management mechanism had unduly influenced the user’s freedom to choose not to give consent. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. The Supreme Administrative Court had to decide whether a website’s cookie policy was unlawful on the grounds that the consent given by the user on the site could not be considered to have been given voluntarily. The website’s consent management mechanism was designed so that giving consent at the first level of the mechanism was remarkably simple and quick. Users were also guided toward this choice. In contrast, the option to withhold consent was not explicitly presented immediately, and making this choice was significantly slower and more cumbersome for the user. The consent management mechanism had inappropriately influenced the user’s freedom of choice not to grant consent, and granting consent was therefore not based on a genuine opportunity for free choice. The cookie policy was unlawful. Section 205(1) and (2) and Section 330 of the Act on Electronic Communications Services Directive 2002\u002F58\u002FEC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector (Electronic Communications Privacy Directive), as amended by Directive 2009\u002F136\u002FEC, Article 1(1), Article 2, second paragraph, point (f), and Article 5(3) Regulation (EU) 2016\u002F679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation), Article 4(11) and Article 7(4) Decision subject to appeal Helsinki Administrative Court, February 5, 2026, No. 638\u002F2026 Decision of the Supreme Administrative Court The Supreme Administrative Court grants Otavamedia Oy leave to appeal and will review the case. The request for a preliminary ruling from the Court of Justice of the European Union is denied. The appeal is dismissed. The final outcome of the Administrative Court’s decision is not altered. Otavamedia Oy’s request for reimbursement of legal costs is denied. Background In its decision of April 26, 2024, the Finnish Transport and Communications Agency found that the cookie policies on Otavamedia Oy’s suomenkuvalehti.fiwebsite’s cookie policies violate Section 205(1) of the Act on Electronic Communications Services (the Communications Services Act), Section 205(1), among other things, in that accepting all cookies is easier in the website’s consent management mechanism than refusing them, in a manner which also fails to meet the requirements for consent set forth in the General Data Protection Regulation. In this regard, the decision refers, among other things, to the fact that accepting all cookies was possible at the first level of the mechanism, where the relevant option was highlighted in green, whereas opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. This differential treatment of options has had a significant impa","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=KHO_-_KHO:2026:65&diff=52874&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-02T08:27:28+00:00","2026-09-02T10:00:09.082978+00:00",7,[18,21,24],{"name":19,"type":20},"Otavamedia Oy","vendor",{"name":22,"type":23},"ePrivacy Directive","product",{"name":25,"type":23},"GDPR","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":26,"icon":28,"name":29,"slug":30},null,"Policy","policy",[32,36,41,46],{"category":33},{"id":34,"icon":28,"name":25,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":37},{"id":38,"icon":28,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":28,"name":44,"slug":45},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":47},{"id":26,"icon":28,"name":29,"slug":30},[]]