Norway’s cookie rules require many websites to obtain permission before using non-essential cookies and similar tracking technologies.
The main requirements come from section 3-15 of the Norwegian Electronic Communications Act, commonly called Ekomloven. The GDPR also applies when cookies or trackers process personal data.
This guide explains what changed in 2025, when consent is required, which technologies may qualify for an exception, and what a Norwegian cookie banner should include.
Norwegian websites generally need prior consent before using cookies or similar technologies for advertising, profiling, analytics, and other non-essential purposes.
Since 1 January 2025, consent under Ekomloven must meet the GDPR standard. It must be freely given, specific, informed, unambiguous, and based on a clear positive action.
What Are Norway’s Cookie Consent Laws?
Norway is not a member of the European Union, but it belongs to the European Economic Area and applies the GDPR.
Cookies and similar technologies are mainly regulated through:
- Ekomloven section 3-15: controls the storage of information on and access to information from a user’s device;
- the Norwegian Personal Data Act: incorporates the GDPR into Norwegian law;
- the GDPR: applies when information collected through cookies or tracking technologies is personal data;
- official guidance: published by the Norwegian Communications Authority and the Norwegian Data Protection Authority.
The Norwegian Communications Authority is commonly known as Nkom. The Norwegian Data Protection Authority is called Datatilsynet.
If you want to compare Norway with other regions, begin with our guide to cookie consent laws around the world.
What Changed on 1 January 2025?
A new version of Ekomloven entered into force on 1 January 2025. According to official guidance from Nkom, one of the most important changes concerned the standard of consent required for cookies and similar technologies.
Under the previous approach, browser settings could play a greater role in indicating whether cookies were permitted. Under the new rules, valid consent must satisfy the GDPR standard.
This means consent must be:
- freely given;
- specific;
- informed;
- unambiguous;
- given through an active action;
- documentable;
- as easy to withdraw as it was to give.
Websites should therefore not rely on default browser settings, inactivity, pre-ticked categories, or continued browsing as proof of consent.
The 2025 change did not create a completely separate Norwegian consent model. It brought the Norwegian cookie consent standard into line with the GDPR requirements used throughout the European Economic Area.
How Do Ekomloven and the GDPR Work Together?
Ekomloven and the GDPR work together, but they regulate different parts of online tracking.
| Rule | Main Purpose | When It Applies |
|---|---|---|
| Ekomloven § 3-15 | Controls storage and access technologies | When information is stored on or accessed from a user’s device |
| GDPR | Controls the processing of personal data | When cookie or tracking information identifies or relates to a person |
Ekomloven applies regardless of whether the information being stored or accessed is personal data.
If a tracking identifier is linked to an individual, device, account, or visitor profile, the related processing may also fall under the GDPR.
The website owner must then satisfy both sets of requirements. Ekomloven controls whether the technology may be used, while the GDPR controls the related processing of personal data.
An advertising cookie stores an identifier in a visitor’s browser. Ekomloven controls whether the website may place or access that cookie. If the identifier is used to follow the visitor or create an advertising profile, the GDPR also applies.
Our separate guide explains the broader EU cookie consent rules under the GDPR and ePrivacy framework.
Which Technologies Are Covered by Ekomloven?
Ekomloven section 3-15 is technology-neutral. It is not limited to files that are traditionally labelled as browser cookies.
The rule can apply to technologies that store information on or access information from equipment such as a computer, mobile phone, or tablet.
Covered technologies may include:
- browser cookies;
- tracking pixels and web beacons;
- local storage and session storage;
- advertising identifiers;
- scripts and tags;
- device fingerprinting;
- link decoration and tracking parameters;
- embedded videos, maps, and social media services;
- mobile app identifiers and software development kits;
- similar technologies used on connected devices.
The rule applies to all types of information, not only personal data. It can also cover first-party and third-party technologies.
Learn more about the technologies you may find in our guide to the different types of website cookies.
When Is Cookie Consent Required in Norway?
Prior consent is generally required when a cookie or similar technology does not meet one of the two limited exceptions under Ekomloven.
Website owners should normally obtain consent before using technologies for:
- online and personalised advertising;
- cross-site or cross-device tracking;
- visitor profiling;
- social media tracking;
- advertising measurement;
- personalised content based on behaviour;
- building audience segments;
- recording individual visitor sessions;
- many analytics purposes.
These technologies should remain disabled until the visitor has received the necessary information and made a valid choice.
Loading the technologies when the page opens and asking for permission afterwards does not meet the prior-consent requirement.
Legitimate interests under the GDPR cannot normally be used to avoid a consent requirement created by Ekomloven. If Ekomloven requires consent, the technology should wait until valid consent has been received.
Which Cookies Can Be Used Without Consent?
Ekomloven section 3-15 contains two exceptions to the consent requirement. Nkom explains that both exceptions should be interpreted narrowly.
| Exception | What It Covers | Possible Example |
|---|---|---|
| Communication | Storage or access used solely to transmit a communication over an electronic communications network | A load-balancing technology required to route a communication |
| Strictly Necessary | Technology essential to provide an online service explicitly requested by the user | A shopping cart, login, or security cookie required for a requested function |
| Non-Essential | Technology used for purposes that are not required to provide the requested service | Advertising, profiling, or cross-site tracking cookies |
Communication exception
The communication exception applies when storage or access is used solely to transmit a communication over an electronic communications network.
Nkom explains that this exception is mainly relevant to electronic communications providers. It is not a general exception for every technology needed to operate a commercial website.
Strictly necessary exception
The strictly necessary exception applies when a technology is essential to provide a function explicitly requested by the visitor.
Possible examples include:
- remembering products in an online shopping basket;
- maintaining a secure login session;
- authenticating a user;
- supporting essential payment or security functions;
- remembering a visitor’s cookie consent choices;
- load balancing required to deliver the service.
A cookie does not become strictly necessary simply because it is useful to the website owner, improves analytics, or makes advertising more effective.
If the same technology is used for both a necessary purpose and a separate advertising or profiling purpose, the additional purpose may still require consent.
Do Analytics Cookies Require Consent in Norway?
Analytics cookies will commonly require consent in Norway because website measurement is not usually essential to provide the service requested by the visitor.
Consent is particularly likely to be required when analytics is used to:
- track individual visitors over time;
- create visitor profiles or audience segments;
- connect website behaviour with advertising information;
- measure advertising performance;
- share information with third-party providers;
- follow visitors across different websites or services;
- personalise content for specific people or groups.
Website owners should not assume that an analytics cookie is exempt simply because its purpose is to improve the website.
The correct assessment depends on whether the technology is strictly necessary to deliver a service expressly requested by the visitor. Standard website analytics will normally have difficulty meeting that test.
Our separate guide explains what website owners should consider when configuring Google Analytics cookie consent.
What Counts as Valid Cookie Consent in Norway?
Consent must provide the visitor with a genuine and fair choice.
For consent to be valid under Ekomloven and the GDPR, the visitor should understand:
- which technologies the website wants to use;
- which information is collected or accessed;
- the purpose of each technology;
- which third parties receive or access the information;
- how long the technologies remain active;
- how to accept or reject different purposes;
- how to withdraw consent later.
Valid consent requires an active choice. The following methods are not sufficient:
- pre-ticked checkboxes;
- pre-enabled non-essential categories;
- silence or inactivity;
- scrolling the page;
- continuing to browse the website;
- browser settings that allow cookies by default.
The website should also keep records showing when consent was obtained, what information was presented, and which purposes the visitor accepted.
Want a beginner-friendly explanation of the GDPR consent requirements used in Norway?
Norway Cookie Banner Requirements
A website does not automatically need a consent banner simply because it operates in Norway. The correct mechanism depends on the technologies the website uses.
If a website uses non-essential cookies or trackers, its consent banner should generally:
- appear before non-essential technologies are activated;
- clearly explain why the technologies are used;
- identify the information being collected or accessed;
- provide an option to accept non-essential technologies;
- provide an equally accessible option to reject them;
- allow separate choices for different purposes;
- avoid pre-enabled non-essential categories;
- provide clear information about relevant third parties;
- link to complete cookie and privacy information;
- allow visitors to change or withdraw their choices later;
- work correctly on desktop, mobile, and tablet devices.
Example of an appropriate first layer
A simple first layer could include:
- Accept All
- Reject Non-Essential
- Customise Choices
The second layer can provide controls for individual purposes and more detailed information about providers, technologies, and duration.
Banner designs to avoid
A Norwegian cookie consent banner should not:
- activate marketing or analytics technologies before a choice is made;
- include only an acceptance button;
- hide the rejection option inside a complicated settings menu;
- require more clicks to reject than to accept;
- use a much brighter or larger acceptance button;
- use confusing or misleading button labels;
- treat scrolling or continued browsing as consent;
- make withdrawing consent more difficult than giving it.
Want to check whether your banner includes the right choices and controls? See our complete guide to cookie banner requirements.
Does a Norwegian Cookie Banner Need a Reject All Button?
Ekomloven does not require every website to use one exact button label. However, Nkom and Datatilsynet state that saying no must be as easy as saying yes.
If a banner displays an “Accept All” button on its first layer, the clearest approach is to provide a visible “Reject Non-Essential” or “Reject All” option on the same layer.
The rejection option should receive comparable attention. It should not be hidden, displayed in a much less visible colour, or placed behind extra clicks.
A banner displays “Accept All,” “Reject Non-Essential,” and “Customise” as three clearly visible controls. Advertising and analytics technologies remain disabled unless the visitor actively accepts them.
Are Cookie Walls Allowed in Norway?
A cookie wall prevents a visitor from accessing a website or service unless they accept non-essential cookies.
Datatilsynet explains that making access conditional on consent can remove the visitor’s genuine choice. If the visitor cannot refuse without losing access to the service, the consent may not be freely given.
For a standard website, access should therefore not normally depend on accepting advertising, profiling, or other non-essential tracking.
Providing an acceptance button together with a link that says “Leave Website” does not give the visitor the same choice as accepting or rejecting non-essential technologies while continuing to use the website.
Does a Norwegian Website Need a Cookie Policy?
Under Ekomloven, visitors must receive information about the technologies being used before they provide consent.
The information should normally explain:
- which cookies and similar technologies are used;
- which information is stored or accessed;
- the purpose of each technology;
- who processes or receives the information;
- whether the technology is first-party or third-party;
- how long it remains active;
- whether consent is required or an exception is being used;
- how visitors can manage or withdraw their choices.
The most important information should appear in the consent interface. More complete details can be provided through a cookie policy or second banner layer.
The information should use clear and simple language rather than unnecessary legal or technical terminology.
Learn how to organise this information in our guide on how to create a cookie policy page.
Do Norway’s Cookie Laws Apply to Websites Outside Norway?
A website does not necessarily avoid Norwegian requirements because its company or server is located in another country.
Relevant factors can include:
- whether the service is offered to people in Norway;
- whether the website targets Norwegian customers;
- where the visitor and their device are located;
- which tracking technologies are used;
- whether personal data about people in Norway is processed;
- whether visitor behaviour in Norway is monitored.
The geographical scope of Ekomloven and the GDPR should be assessed separately. An international website may also need to consider EU, UK, Swiss, or other regional privacy laws at the same time.
Do not determine the applicable law only from the location of your company. Visitor location, service targeting, tracking activities, and the type of information collected may also matter.
Who Enforces Norway’s Cookie Rules?
Nkom and Datatilsynet share responsibility for supervising Ekomloven section 3-15.
| Authority | Main Responsibility |
|---|---|
| Nkom | Assesses whether a technology falls within section 3-15 and whether one of the technical exceptions applies |
| Datatilsynet | Assesses whether sufficient information is provided, consent meets the GDPR standard, and withdrawal is properly supported |
A website owner remains responsible for ensuring that its own website, consent mechanism, and third-party technologies comply with the applicable requirements.
Using a third-party cookie banner or consent management platform does not automatically make the website compliant. The tool must still be configured correctly.
What Happens If a Website Does Not Comply?
Possible regulatory action can include:
- requests for information;
- website and banner inspections;
- orders to change how tracking technologies are used;
- requirements to stop unlawful processing;
- requirements to delete unlawfully collected information;
- penalties under Ekomloven;
- GDPR sanctions where personal data processing also infringes the GDPR.
Datatilsynet has also investigated Norwegian websites for unlawfully sharing visitor information through tracking pixels.
Compliance decisions should not be based only on the possible size of a fine. Incorrect tracking can also cause complaints, loss of visitor trust, inaccurate consent records, and problems with analytics or advertising providers.
Practical Norwegian Cookie Compliance Checklist
Website owners can use the following steps to review their Norwegian cookie consent setup.
Use these steps to review whether your website follows Norway’s cookie consent requirements.
- Identify your technologies. Check cookies, pixels, scripts, tags, local storage, embeds, and fingerprinting.
- Record each purpose. Explain why every technology is being used.
- Separate essential technologies. Do not classify a technology as necessary only because it is useful.
- Assess the exceptions. Check whether each exempt technology meets the narrow communication or strictly necessary test.
- Block non-essential technologies. Keep advertising, profiling, and other non-essential tracking disabled before consent.
- Provide balanced choices. Make refusing non-essential technologies as easy as accepting them.
- Offer granular controls. Let visitors choose between different purposes.
- Name relevant third parties. Explain which providers receive or access information.
- Publish clear information. Keep your cookie and privacy information complete and accurate.
- Avoid cookie walls. Do not make ordinary website access dependent on accepting non-essential tracking.
- Allow withdrawal. Give visitors an accessible way to reopen their settings.
- Keep consent records. Record when and how choices were made.
- Test the banner. Confirm that every category responds correctly to visitor choices.
- Repeat the review. Check again when plugins, tags, embeds, or providers change.
A cookie audit can help identify the technologies your website currently loads.
After configuring your consent solution, follow our guide on how to test a cookie banner.
Official Norwegian Cookie Guidance
Website owners can consult the following official Norwegian sources:
- Nkom guidance on cookies;
- Datatilsynet guidance on consent for cookies and tracking technologies;
- Norwegian Electronic Communications Act;
- Datatilsynet information about Norwegian data protection rules.
Because cookie technologies and official guidance can change, website owners should review their setup regularly rather than treating consent configuration as a one-time task.
Conclusion
Norway’s cookie consent requirements are mainly based on Ekomloven section 3-15 and the GDPR.
Since 1 January 2025, consent for non-essential cookies and similar technologies must meet the GDPR standard. It must be freely given, specific, informed, unambiguous, documentable, and based on an active choice.
The communication and strictly necessary exceptions are narrow. Advertising, profiling, cross-site tracking, and many analytics technologies should normally remain disabled until the visitor provides valid consent.
The practical starting point is to identify what the website loads, determine why each technology is used, check whether an exception genuinely applies, and block everything else until the visitor makes a choice.
The next step is to apply these rules to your own website and check which cookies and trackers it uses.
This article provides general information about cookie consent and privacy requirements. It does not constitute legal advice.
Frequently Asked Questions
Common questions about this topic
No. A consent banner is generally needed when a website uses cookies or similar technologies that require consent. A website using only strictly necessary technologies may not need a consent banner, but it should still provide clear information about their use.
A new version of Ekomloven entered into force on 1 January 2025. Consent for non-essential cookies and similar technologies must now meet the GDPR standard and be freely given, specific, informed, unambiguous, and based on an active choice.
Yes. Norway is not an EU member, but it belongs to the European Economic Area and applies the GDPR through Norwegian law. The GDPR applies when cookies or tracking technologies process personal data.
Technologies used solely to transmit a communication or those strictly necessary to provide a service explicitly requested by the visitor may qualify for an exception. Shopping cart, secure login, and consent-preference cookies are possible examples.
Analytics cookies will commonly require consent because website measurement is not normally strictly necessary to provide the service requested by the visitor. Consent is especially likely to be required when analytics tracks individual visitors or shares information with third parties.
Norwegian law does not require one exact button label, but refusing consent must be as easy as accepting it. If an Accept All button appears on the first layer, a visible Reject Non-Essential or Reject All option is generally the clearest approach.
A cookie wall that makes access dependent on accepting non-essential tracking may prevent consent from being freely given. Visitors should normally be able to reject advertising or profiling technologies and continue using the website.
Nkom and Datatilsynet share enforcement responsibility. Nkom assesses whether technologies fall under Ekomloven and whether an exception applies, while Datatilsynet assesses information, consent validity, and withdrawal requirements.
