Finland

Can you place cookies without consent?

No, but there is an exception for necessary cookies in line with ePrivacy Directive, see response 3 below. 

Are cookie rules (whether specific or within general data protection laws) followed in practice?

The practice varies. In September 2021, Finnish Transport and Communications Agency (“Traficom”) published new guidelines on cookies. However, not all those subject to the guidelines have updated their websites yet.

Traficom has issued several decisions obliging entities to comply with cookie regulation and several cases are also pending. 

Are there any exemptions if consent is required?

Essential cookies can be used without consent, otherwise no exemptions.

Can you place the following cookies automatically:

i. Analytics cookies, ii. Advertising cookies, iii. Social media cookies

Cookies can be placed automatically if they are deemed necessary. According to Traficom guidance, necessary cookies include cookies related, for example, to user feeds, data security, accessibility and communication (under certain circumstances).

Analytics, advertising and social media cookies require consent according to the interpretation of the authorities. In a social media context, the consent must be requested when the person signs up to the platform or if the person is not a user, before cookie data is collected.

Are you able to gain consent without a user ticking ‘accept’, i.e., imply consent from a user continuing to browse the site?

No. The consent has to fulfil the requirements of the GDPR, which means it has to be explicit, informed and unambiguous.

Can you set cookies without a cookie notice? 

No.

Can you set cookies without a cookie banner/ management tool?

No. Both cookie notices (which require more information, for example on retention times) and cookie banners are required. 

Are you able to use cookie walls? 

Pay for access might be allowed if alternatives are presented, even though that has not been decided by courts. 

Is the local regulator currently enforcing decisions against breaches of cookie rules?

Traficom has issued several decisions obliging companies to comply with cookie regulation and several cases are also pending.

Are there any current consultations relating to ad tech/cookies?

None that we are aware of.

Are there any anticipated changes to the rules and/ or have there been changes to the attitudes in the market (for example, case law or industry body decisions)?

There are several cases pending and they might lead to new guidance.