Cookie rules

Order of requirements for information and consent for storage of or access to information in end-users’ terminal equipment1)

Pursuant to Sections 9 and 81(2) of law no. 169 of 3 March 2011 on electronic communications and services:

Purpose and scope

Section 1 The purpose of the order is to protect end users from improper storage of information or access to information which is already stored in the end user’s terminal equipment.

Definitions

Section 2 In this order, the following terms are defined as:

1) Terminal equipment:

  A product or relevant component thereof which enables communication and is intended to be directly or indirectly connected to the network termination points in public electronic communications.

2) End user:

  User of electronic communications networks or services who does not make such electronic communications networks or services available to others on a commercial basis. The definition includes service recipients.

3) Information and content service:

  Any kind of electronic provision of information or content to which other end users are given access, via electronic communications networks or services, on the basis of individual requests.

4) Services in the information society (information society services):

  Any service which has a commercial purpose and is delivered online (electronically over a certain distance) on the individual request of a recipient.

5) Service provider:

  A natural or legal person providing an information society service.

6) Legal person:

  Public, private and limited companies and cooperatives, partnerships, associations, foundations, municipalities, regions and state authorities, etc.

7) Third party:

  A natural or legal person who stores information or gains access to information which is already stored in an end user’s terminal equipment via an information and content service of which the natural or legal person is not a provider.

8) Consent:

  Any freely given, specific and informed indication of wishes by which the end user agrees that information will be stored, or that information already stored in the end user’s terminal equipment will be accessed.

(2) The definitions contained in Section 1, Subsections 2 and 3 shall be construed in accordance with the definitions in the Act on Electronic Communications Networks and Services and the regulations established thereunder.

Storage of or access to information in the terminal equipment

Section 3 Natural or legal persons may not store information or access information which is already stored in an end-user terminal equipment, or allow third parties to store information or access information, if the end user does not consent to this after having received complete information about the storage or access to the information.

(2) Information referred to in Section 1 is comprised when it, at a minimum:

1) appears in clear, specific and easily understandable words or equivalent picture systems,

2) contains information about the purpose of storage of or access to data in the end user’s terminal equipment

3) contains information which identifies any natural or legal person who is undertaking the storage of or access to information,

4) contains ready access for the end user to refuse or withdraw their consent to the storage of or access to the data and a clear, specific and easy to understand guide on how the end user will use such access, and

5) is immediately available to the end user by being communicated to them comprehensively and clearly. In addition, when storage of or access to information occurs in the end user’s terminal equipment through an information and content service, the information must be continuously accessible to end users through direct and clearly marked access in the information and content service in question.

Section 4 Notwithstanding Section 3, natural or legal persons may store information or access information which is already stored in an end user’s terminal equipment if:

1) the storage of or access to the information has the sole purpose of transmitting communications over an electronic communications network, or

2) the storage of or access to information is required in order for the provider of an information society service which the end user has explicitly requested to be able to provide this service.

(2) The storage of or access to information in an end user’s terminal equipment is required under Section 1(2), if the storage of or access to information is a technical requirement for providing a service which operates in accordance with the service’s purposes.

Penalties

Section 5 Those who breach Section 3 will receive a fine.

(2) Criminal liability may be imposed on companies etc. (legal persons) under the rules of Chapter 5 of the Criminal Code.

Entry into force

Section 6 This order enters into force on 14 December 2011.

Ministry of Economic and Business Affairs, December 9, 2011

Ole Sohn