Finnish Court Rules Media Company Violated ePrivacy Directive Over Cookie Consent Failures

A Finnish media company failed to obtain explicit user consent before deploying cookies and web tracking requests on its websites, violating the ePrivacy Directive. The ruling clarifies that the ePrivacy Directive's consent requirements extend beyond cookies to all web requests, broadening the compliance surface organisations must manage. This matters because many companies underestimate the scope of consent obligations, assuming only traditional cookies are regulated. Failure to implement proper consent mechanisms can result in regulatory enforcement, reputational damage, and legal costs — even for established media organisations.

Tactical Insight

Immediate Actions

Conduct a full audit of all tracking technologies on your websites, including cookies, pixels, web beacons, and HTTP requests, to map consent obligations.
Implement or update a Consent Management Platform (CMP) to ensure explicit, informed user consent is collected before any non-essential tracking occurs.

Long-term Improvements

Embed privacy-by-design principles into web development workflows so consent requirements are evaluated before new tracking technologies are deployed.
Establish a recurring legal and technical review process to keep consent mechanisms aligned with evolving ePrivacy and GDPR interpretations.
Train web development and marketing teams on the legal distinction between essential and non-essential tracking to prevent inadvertent violations.

Detection & Monitoring Measures

Deploy automated cookie scanning tools to continuously detect new or changed tracking technologies across all web properties.
Establish a monitoring process to review regulatory decisions and guidance from national data protection authorities to proactively identify compliance gaps.