Finland requires opt-in consent before any cookie that is not strictly necessary, under Section 205 of the Act on Electronic Communications Services. Traficom, the Finnish Transport and Communications Agency, supervises that rule, and the Data Protection Ombudsman supervises the GDPR side. In practice, Traficom expects a banner that names each cookie and its purpose, makes refusing as quick as accepting and does not rely on browser settings or "by continuing you accept".
Two regulators, one cookie banner
Finland takes an unusual approach to cookie regulation. Rather than placing all responsibility under a single data protection authority, Finnish law divides oversight between two bodies: the Finnish Transport and Communications Agency (Traficom) and the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
Traficom supervises the technical rules around cookies and similar tracking technologies under the Act on Electronic Communications Services (917/2014). The Data Protection Ombudsman handles the broader GDPR consent requirements that apply to any personal data processing triggered by those cookies.
If your website serves Finnish visitors, you must comply with both sets of rules simultaneously.
Section 205 is Finland's ePrivacy transposition
Section 205 of the Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista) is Finland's transposition of Article 5(3) of the ePrivacy Directive. It governs the storage of cookies and similar technologies on a user's device.
The rule is straightforward: storing or accessing information on a user's terminal equipment requires prior consent, unless the cookie is strictly necessary to provide a service the user has explicitly requested. Legitimate interest is not a valid legal basis under Section 205: Traficom's guidance states that the legitimate interest defined in the GDPR does not permit storing cookies on user devices.
Strictly necessary cookies, such as session identifiers like PHPSESSID, authentication tokens and load-balancing cookies, are exempt from the consent requirement. Traficom still recommends informing users about these cookies, even though consent is not legally required for them.
Traficom's cookie guidance in practice
Traficom's National Cyber Security Centre (NCSC-FI) publishes cookie guidance clarifying what service providers must do. The guidance is not legally binding in itself, but Traficom has warned that deviating from it means assuming the risk of unlawful action.
The key requirements are:
Your cookie banner must specify each cookie's name, type, purpose, and validity period
You must disclose whether cookie data is shared with third parties
Consent must be opt-in: referring users to browser settings, or saying that continuing to use the site means accepting cookies, is not valid consent
Refusing non-essential cookies must be as easy as accepting them, with no dark patterns
Keep a record of each consent for as long as you may need to show it was given. Traficom's guidance page sets no fixed retention period for those records.
Cookie categories under Finnish rules
Finnish regulators apply the standard EU approach to cookie categories, but enforcement decisions have shown they scrutinise categorisation closely. In the 2023-2024 enforcement cases, Traficom found that companies had incorrectly classified marketing and analytics cookies as "necessary" to avoid collecting consent.
| Category | Consent required? | Examples |
|---|---|---|
| Strictly necessary | No | PHPSESSID, login tokens, CSRF tokens |
| Functional | Yes | Language and accessibility preferences |
| Analytics | Yes | _ga, _pk_id, _pk_ses |
| Marketing or advertising | Yes | _fbp, _gcl_au, ad network pixels |
The Data Protection Ombudsman covers the GDPR side
While Traficom covers the ePrivacy side, the Data Protection Ombudsman enforces the GDPR. When cookies process personal data, as most analytics and marketing cookies do, both regulatory frameworks apply at once.
The Deputy Data Protection Ombudsman issued a landmark decision in May 2020, ruling that instructing users to manage cookie preferences through browser settings does not constitute valid consent under the GDPR. This decision aligned Finnish practice with the Court of Justice of the EU's Planet49 ruling and made clear that cookie consent in Finland must meet the GDPR standard: freely given, specific, informed, and unambiguous.
The Ombudsman's sanctions board can impose GDPR fines, and it has done so in several cases since the GDPR took effect, though few concern cookies specifically.
Court rulings that shaped Finnish cookie law
Traficom's decisions can be appealed to the Administrative Court, and two Helsinki Administrative Court decisions reported from 2024 strengthened the enforcement framework. Both cases involved appeals against Traficom decisions finding Section 205 violations.
In the first case, a Finnish media company was found to have placed non-essential cookies without proper consent on multiple websites. Traficom identified that the company's consent mechanism made it easier to accept all cookies than to reject them, and that several cookies had been misclassified as necessary.
The second case involved a Finnish telecommunications company that set chat-service cookies without user consent. The court upheld Traficom's position in both cases, ordering the companies to make non-essential cookies consent-based, allow refusal at the first interaction level, and provide clearer cookie information.
These rulings confirmed that Section 205 consent must be interpreted in line with GDPR standards.
How Finland compares to other Nordic countries
Finland's dual-regulator model is common in the region. In Sweden, the Post and Telecom Authority (PTS) supervises the cookie rule in the Electronic Communications Act and IMY the GDPR. In Denmark, the Agency for Digital Government (Digitaliseringsstyrelsen) supervises the cookie order and Datatilsynet the GDPR. Estonia consolidates regulation under its Data Protection Inspectorate (AKI).
| Country | Cookie rule authority | GDPR authority | Key cookie law |
|---|---|---|---|
| Finland | Traficom | Data Protection Ombudsman | Act on Electronic Communications Services, s.205 |
| Sweden | PTS | IMY | Electronic Communications Act (LEK) |
| Denmark | Digitaliseringsstyrelsen | Datatilsynet | Cookie Order (Cookiebekendtgørelsen) |
| Estonia | AKI | AKI | Electronic Communications Act |
The practical outcome for website owners is the same across all four countries: prior opt-in consent is required for non-essential cookies, and the consent standard aligns with the GDPR.
Checklist for Finnish cookie requirements
Use this checklist to verify your website meets Finnish cookie rules:
Audit your cookies: run a full cookie scan to identify every cookie and tracker on your site, including those set by third-party scripts
Classify correctly: only session-critical cookies qualify as strictly necessary, and analytics and marketing cookies always need consent
Use opt-in consent: display a cookie banner that collects affirmative consent before any non-essential cookies fire
Equal accept and reject options: rejecting cookies must be equally prominent and require the same number of clicks as accepting
Provide granular choices: allow users to consent to individual cookie categories rather than forcing an all-or-nothing choice
Disclose cookie details: list each cookie's name, purpose, duration, and whether data is shared with third parties
Store consent records: keep proof of each consent for as long as you may need to show it
Make withdrawal easy: visitors must be able to revoke consent at any time, with the same ease as giving it
Connect Google Consent Mode: if you use Google services, configure Consent Mode v2 to follow visitors' choices
Finnish cookie terms and short answers
Finnish banners and guidance use a handful of terms you will meet when checking a site for Finnish visitors:
- Eväste
- Cookie (plural evästeet).
- Suostumus
- Consent.
- Traficom
- The Finnish Transport and Communications Agency, which supervises Section 205.
- Tietosuojavaltuutettu
- The Data Protection Ombudsman, which supervises the GDPR.
Does Finland require cookie consent for analytics cookies?
Yes. Under Section 205 of the Act on Electronic Communications Services, analytics cookies such as _ga or _pk_id require prior opt-in consent because they are not strictly necessary to deliver a service the user requested.
Can I rely on browser settings for cookie consent in Finland?
No. The Deputy Data Protection Ombudsman ruled in 2020 that directing users to browser settings does not constitute valid consent. You must collect consent through an active opt-in mechanism on your website.
How long must I store cookie consent records in Finland?
Finnish law sets no fixed period. Keep each consent record for as long as you may need to show that valid consent was given, for example for as long as the consent is relied on plus any period in which a complaint could follow.
Is rejecting cookies allowed to require more clicks than accepting?
No. Traficom's guidance says refusing non-essential cookies must be as easy as accepting them, and the Administrative Court upheld orders to allow refusal at the first level of the banner.
Do Finnish cookie rules apply to websites outside Finland?
If your website targets Finnish users or processes data of people in Finland, Finnish regulations and the GDPR apply regardless of where your servers or business are located.
List every cookie your Finnish banner must name
Traficom expects each cookie to be named with its purpose and duration, so start with a scan. Kukie.io detects and categorises the cookies it finds, shows a banner in Finnish with Reject all beside Accept all and records each choice. The global compliance hub covers the other countries your visitors come from.
