Book a demo
Login to console
  • Country focus

Finnish cookies and consent regulation: what you need to know

Published on April 15, 2022 by Thierry Maout

Updated on May 27, 2022 by Thierry Maout

In November 2021 new cookie and consent regulations came into effect in Finland. Finnish companies now have to review how they are collecting and storing personal data and adapt according to the new regulations.

 

So, what are the new rules for using cookies in Finland? What proof do you need in order to demonstrate legally collected consent? How can you ensure compliance? In this article, we’ll tackle all these topics and more.

 

Summary : 

 

 


 

Regulation changes since 2021

 

Finland updated their cookies and consent regulations in 2021. The main changes came from Finland’s administrative court, which concluded that internet browser settings alone could no longer grant valid consent for the use of non-essential cookies. 

 

The court also considered that the Finnish Transport and Communications Agency (Traficom) was the competent authority on cookie regulation and supervising the use of cookies. Traficom is also in charge of interpreting the definition of consent in questions relating to cookie usage.

 

Scope of application

 

The updated regulation applies to companies that use cookies and similar technologies to store or access personal data stored on user devices when using websites or electronic communication services.

 

The guidelines also recommend that service providers think carefully about the following aspects of cookie usage:

 

  • What cookies or technologies they’ll be relying on.

  • How cookies can be classified into essential and non-essential cookies.

  • Is key information about cookie usage and the purpose of their use being shown to users in a clear, easy-to-understand way?

  • How does the service request consent for non-essential cookies?

  • How does the service allow users to change their cookie settings or remove their consent?

 

Lastly, the regulations also outline how non-personal data can become personal data. On its own, information such as IP addresses, advertising ID, purchasing history or details on when a website has been accessed don’t count as personal data.

 

However, if this type of information is collected extensively, especially for the purposes of profiling, targeting or influencing, it’s more likely to count as personal data.

 

The compliance requirements of Finnish cookie law

 

Here’s a quick breakdown of the key compliance requirements for Finnish cookie law:

 

  • Consent required for non-essential cookies: You have to obtain the user’s consent in order to use any kind of non-essential cookies. Whether a cookie or tracker is essential depends on the purpose of its use. An essential cookie is purely technical and must be present to provide the basic functionality of the website. A non-essential cookie is used to analyze users behavior or to display advertisements using platforms such as Google Analytics, Tealium, Facebook or Taboola.

 

  • No legitimate interest possible: The legitimate interest of a data controller as described in the GDPR guidelines doesn’t give a right to store cookies on a user’s device or use other tracking technologies.

 

  • No setting cookies before consent is granted: User permission must be obtained before any non-essential cookies can be set.

 

  • Consent form: To obtain consent, users should be provided with a clear, easy-to-understand form with options to accept all cookies, refuse all cookies or only accept essential cookies. Service providers should also offer a second, more detailed form with additional options.

 

  • Opt-in only: Cookie banners aren’t allowed to include pre-ticked boxes or slide switches in the ‘on’ position. Users can only agree to accept cookies by deliberately asking to opt in.

 

  • Scrolling isn’t consent: Simply scrolling down a form or page doesn’t count as consent. A user has to click on an option to accept cookies.

 

  • Express consent only: GDPR states that only a freely given, specific, informed and unambiguous indication of a preference counts as consent. Silence, pre-ticked boxes or inactivity doesn’t count.

 

  • Withdrawal of consent should be as easy as giving consent: This means that the process for removing consent should be just as uncomplicated as the process for giving consent.

 

  • Proof of consent is required: These include the date and time when consent was requested and obtained, how consent was requested, what information was provided to request consent, and the credentials that identify who or from which device consent was given.

 

This last point is something you can manage with our Versions and Proofs feature. Check out our dedicated help center article to learn more:

 

Versions and Proof

 

Different kinds of cookies

 

It’s also worth bearing in mind that cookies come in many different forms. Here’s a short, non-exhaustive list of the different kinds of cookies you should be aware of if you want to be compliant with Finnish cookie law:

 

  • Authentication cookies: These are used to authenticate users when they log into sites or apps. They might be ‘session specific’, meaning that they’re used to grant access to secure areas of a site and maintain login. Session-specific cookies are more likely to be considered essential, whereas cookies enabling a permanent login might not be considered essentials if the user isn’t informed that a long-term login is being maintained.

 

  • Cookies related to user preferences: These cookies are used to remember preferences such as language choices, fonts or text size. These are considered essential, whereas cookies that enable site recommendations based on previous user interactions aren’t.

 

  • Cookies related to user input: These cookies hold data such as the contents of an online shopping cart. They are considered essential because they enable actions that are necessary to provide a service.

 

  • Advertising cookies: Advertising Cookies are used to collect data about the user from their device. This data is then used to display relevant advertisements towards the user. Examples of such cookies are from Facebook, Adroll, YouTube, Criteo and Hubspot.

 

  • Cookies related to information security: These are used to keep data secure when it's being transmitted between a user and a service, for example an image recognition CAPTCHA. Because they support the safe use of a service, they’re considered essential cookies. No consent is required for information security cookies.

 

  • Analytics cookies: These cookies are used to collect data on how visitors use a service, for example counting page views. Because it’s possible to run a service without the use of analytics, these cookies aren’t considered essential and require consent.

 

 Informing users

 

BLOG - Finland REGULATION (1)

Another important aspect of Finnish cookie and consent regulation is properly informing users about the use and storage of cookies. If a user chooses to grant, reject or withdraw consent, they should always be informed about usage and storage. Traficom also recommends informing users even when no consent is required.

 

Banners or pop-ups that request consent should at the very least include the following information:

 

  • Whether cookies are being used, and if so what types are being used.

  • The purpose of the cookies used.

  • The validity period of the cookies used.

  • An indication as to whether the data collected by any cookies is being shared with third parties.

 

How Didomi can help you navigate Finnish cookies and consent regulation

 

Whether you’re operating in Finland or anywhere else, effectively managing user privacy and cookie consent is key. But getting started can often feel overwhelming.

 

The good news is: You don’t have to do it all by yourself.

 

The Didomi Consent Management Platform (CMP) can help you become GDPR-compliant and create personalized privacy notices, increasing your opt-in rates and getting access to first-hand user data all while showing exemplary compliance and reducing legal risk.

 

Contact us for any queries about Finnish cookie law or for more information on our solutions.

 

Book a demo

avatar Thierry Maout

Thierry Maout

Content marketing manager at Didomi. In my free time I enjoy writing about tech, education, and MMA.

Related articles