KHO - KHO:2026:65

Summary

Finnish courts have upheld a decision against a media company regarding its cookie consent banner. The Finnish Transport and Communications Agency found that the banner made accepting all cookies easier than rejecting them, violating GDPR and the Finnish Act on Electronic Communications Services. Appeals to the Administrative Court and Supreme Administrative Court confirmed that the consent mechanism unduly influenced user choice, deeming consent not freely given.

Full text

Help KHO - KHO:2026:65: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:44, 8 September 2026 view sourceLs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators390 editsmTag: Visual edit← Older edit Latest revision as of 09:23, 8 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators166 edits Tag: Visual edit (One intermediate revision by the same user not shown)Line 105: Line 105: === Facts ====== Facts === A media company (the controller) utilised a two-layer banner to request user consent for the use of cookies on the website of a language news magazine owned by the controller ([https://suomenkuvalehti.fi/ suomenkuvalehti.fi]). The first layer of the banner primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the banner for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers.A media company (the controller) utilised a two-layer banner to request user consent for the use of cookies on the website of a magazine specialised in language owned by the controller ([https://suomenkuvalehti.fi/ suomenkuvalehti.fi]). The first layer of the banner primarily consisted of brief general information about the use of cookies and included “Accept All” and “Settings” buttons. Clicking the “Settings” button opened up the second level of the banner for the user. The second layer contained, among other things, tabs, subheadings, menus, detailed information on the use of cookies and other data, as well as the buttons “Reject All,” “Accept Selected,” and “Accept All”. The “Accept All” button was highlighted with a green background on both layers. A data subject filed a complaint against the controller on '''XXXX (date).''' On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it found that accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. As a result, the consent was obtained in violation of [[Article 4 GDPR|Article 4(11) GDPR]] and [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Finnish Act on Electronic Communications Services], the national implementation of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive]. '''(Comment LS: I rephrased this a bit, please change if section 205(1) is not the implementation of 5(3) eprivacy)'''On 26 April 2024, the Finnish Transport and Communications Agency issued a decision where it found that accepting all cookies was easier for the user than rejecting them. The agency pointed out that opting out of non-essential cookies required clicking a settings button, scrolling all the way down the settings menu, and finally clicking the opt-out button. As a result, the consent was obtained in violation of [[Article 4 GDPR|Article 4(11) GDPR]] and [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Finnish Act on Electronic Communications Services], the national implementation of [https://eur-lex.europa.eu/eli/dir/2002/58/oj Article 5(3) ePrivacy Directive]. The controller appealed the agency's decision to the Administrative Court of Helsinki. The court of first instance dismissed the appeal and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller appealed the agency's decision to the Administrative Court of Helsinki. The court dismissed the appeal and pointed out that opting out of non-essential cookies required at least two clicks, whereas consent could be given with a single click. The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]].The controller subsequently appealed this decision to the Supreme Administrative Court and also requested the case to be referred to the CJEU for a preliminary ruling regarding the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]]. Line 115: Line 115: The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]] to be sufficiently clear. The Supreme Administrative Court came to the same conclusion as the previous instances and dismissed the controller’s appeal. First, the court found that there were no grounds to refer the case to the CJEU for a preliminary ruling: it considered the interpretation of [[Article 4 GDPR|Articles 4(11)]] and [[Article 7 GDPR|7(3) GDPR]] to be sufficiently clear. Second, the court held that the cookie policy at issue violated [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Act on Electronic Communications Services], as the consent given by the user could not be considered freely given. The court interpreted Section 205 of the Communications Services Act in light of EU law and CJEU jurisprudence. In particular, the court referred to the CJEU’s decisions in the cases [[CJEU - C-673/17 - Planet49|C-673/17 ''Planet49'']] and and [[CJEU - C-61/19 - Orange Romania|C-61/19 ''Orange România'']]. In ''Planet49'', the CJEU emphasised that consent requires active behaviour by the user in order to be freely given.<ref>CJEU - C-673/17 ''- Planet49'', margin number 56.</ref> In ''Orange România'', the controller had unduly influenced the data subject’s freedom to object to the processing of their data by requiring the data subject to fill out an additional form to withdraw their consent.<ref>CJEU - C-61/19 - ''Orange România'', margin numbers 50 and 52.</ref>Second, the court held that the cookie banner at issue violated [https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205 Section 205(1) of the Act on Electronic Communications Services], as the consent given by the user could not be considered freely given. The court interpreted Section 205 of the Communications Services Act in light of EU law and CJEU jurisprudence. In particular, the court referred to the CJEU’s decisions in the cases [[CJEU - C-673/17 - Planet49|C-673/17 ''Planet49'']] and and [[CJEU - C-61/19 - Orange Romania|C-61/19 ''Orange România'']]. In ''Planet49'', the CJEU emphasised that consent requires active behaviour by the user in order to be freely given.<ref>CJEU - C-673/17 ''- Planet49'', margin number 56.</ref> In ''Orange România'', the controller had unduly influenced the data subject’s freedom to object to the processing of their data by requiring the data subject to fill out an additional form to withdraw their consent.<ref>CJEU - C-61/19 - ''Orange România'', margin numbers 50 and 52.</ref> The court argued that accepting all cookies was remarkably simple and quick, and users were guided towards this choice. In contrast, the option to withhold consent was not explicitly presented right away, and opting out of non-essential cookies was significantly slower and more cumbersome for the user. Thus, the consent management mechanism had unduly influenced the user’s

Indicators of Compromise

• url — https://suomenkuvalehti.fi/
• url — https://www.finlex.fi/fi/lainsaadanto/2014/917#part_7__chp_24__sec_205
• url — https://eur-lex.europa.eu/eli/dir/2002/58/oj

Entities