[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIc6L-nIyhZBTwMaHZEDFUNLLuMNLrDVQ0bpmR8epITA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"d9f839b8-95ef-4949-be90-0463ae7c50b8","KHO - KHO:2026:65","kho-kho-2026-65-5c32c2","← Older revision Revision as of 15:04, 9 September 2026 Line 100: Line 100: }} }} The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed the user to consent in violation of the national implementation of [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj Article 5(3) ePrivacy Directive.] The Supreme Administrative Court held that a media company's cookie banner made it significantly more difficult to reject non-essential cookies. The design unduly pushed users to consent in violation of the national implementation of [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2002\u002F58\u002Foj Article 5(3) ePrivacy Directive.] == English Summary == == English Summary ==","Finland's Supreme Administrative Court ruled that a media company's cookie banner design made it too difficult to reject non-essential cookies, unduly pushing users towards consent. This design violated the national implementation of Article 5(3) of the ePrivacy Directive, as well as GDPR provisions regarding consent.","Finnish court rules media company's cookie banner violates ePrivacy Directive.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=KHO_-_KHO:2026:65&diff=52992&oldid=52990","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-09T15:04:10+00:00","2026-09-09T16:00:12.278925+00:00",7,[17],{"name":18,"type":19},"Otavamedia Oy","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":63},"finnish-court-rules-deceptive-cookie-banner-violates-gdpr-and-eprivacy-directive","Finnish Court Rules Deceptive Cookie Banner Violates GDPR and ePrivacy Directive","A Finnish media company's cookie banner was designed in a way that made rejecting non-essential cookies unnecessarily difficult, effectively nudging users toward consent rather than offering a genuine, freely-given choice. Finland's Supreme Administrative Court found this practice violated Article 5(3) of the ePrivacy Directive and GDPR consent requirements, which mandate that consent be as easy to withdraw or deny as it is to give. This is a textbook example of a 'dark pattern' — a design choice that technically appears compliant while undermining user autonomy. The ruling underscores that compliance is not just about having a consent mechanism, but ensuring it is fair, balanced, and transparent. Organizations that rely on consent as a legal basis for data processing must treat UI\u002FUX design decisions as regulatory decisions.",[53,54,55,56,57,58,59,60,61,62],"GDPR Article 4(11) — Definition of valid consent","GDPR Article 7 — Conditions for consent","GDPR Article 25 — Data protection by design and by default","ePrivacy Directive Article 5(3) — Cookie consent requirements","EDPB Guidelines 03\u002F2022 on Dark Patterns in Social Media Platforms","EDPB Guidelines 05\u002F2020 on Consent under the GDPR","NIST Privacy Framework PR.AT-P1 — Privacy awareness and training","NIST Privacy Framework GV.PO-P1 — Privacy policy documentation","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 29101 — Privacy architecture framework",{}]