Sanoma must obtain consent for personalisation cookies and certain web calls

Korkein hallinto-oikeus (KHO) has upheld an order requiring Sanoma Media Finland Oy to make the personalisation and editorial-analytics cookies at issue on its news websites subject to user consent.Finlex In KHO:2026:64, the court also upheld the requirement for certain web calls.Finlex It dismissed Sanoma’s appeal on those issues and refused leave to appeal on the remaining matters.

The decision turns on the narrow exception to the consent rule in section 205 of the Act on Electronic Communications ServicesFinlex. That rule generally requires consent and information about the purpose of storing or using device data. The exception covers transmission-only operations or operations necessary to provide a service expressly requested by the user.Finlex Article 5(3) of the ePrivacy Directive requires strict necessity for the requested-service exception.

The court found that arriving at a news website did not establish that users expressly requested content personalised through monitoring and analysing their behaviour.Finlex Sanoma’s user research did not reliably establish that expectation either. A provider’s choices about how to build its service could not determine necessity. The fact that the cookies were first-party cookies did not itself justify an exemption.

Sanoma’s arguments about editorial freedom and the European Media Freedom Act did not change the outcome. The consent order left the company free to decide what to publish and when. It also allowed personalised journalism where users consented and received appropriate information. The restriction concerned personalisation based on tracking and analysis without consent.

For web calls, the court held that section 205 also covers access to information already stored on a device, even where the provider does not itself store that information.Finlex Different technical operation from cookies did not exclude web calls from the rules. The calls examined transmitted device information, including browser and operating-system details, and therefore fell within the provision.Finlex

The ruling does not make every web call consent-dependent.Finlex Liikenne- ja viestintävirasto had already accepted an exemption for some calls. For those covered by the order, Sanoma’s incomplete information left the exemption conditions unproven. The court said that the party relying on an exception generally must provide sufficient evidence that its conditions are met. For website compliance teams, that makes documenting each call’s purpose and the claimed necessity a practical priority.