Website compliance in Finland: cookies, GDPR and accessibility

Finland applies the same EU rules as the rest of the union — GDPR for personal data, ePrivacy for cookies and storage, and the European Accessibility Act for accessibility — but its implementation has two distinctive features: cookie oversight is split between two regulators, and Finland was an early mover in ending “consent” by browser settings. This guide maps the three frameworks as they apply to a Finnish website in 2026.

The three frameworks that apply

• GDPR + Tietosuojalaki. The GDPR applies directly, supplemented by the Finnish Data Protection Act (Tietosuojalaki, 1050/2018). The regulator is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu).
• ePrivacy via the Act on Electronic Communications Services. The cookie-storage rule is Section 205 of Act 917/2014, supervised by Traficom.
• EAA via the Act on the Provision of Digital Services. The European Accessibility Act was implemented through amendments to existing laws, including Act 306/2019, in scope from 28 June 2025.

Cookies: Section 205 and active consent

Under Section 205 of the Act on Electronic Communications Services, storing or reading information on a user’s terminal equipment requires consent unless the storage is strictly necessary to deliver the service the user requested. Analytics cookies such as _ga or _pk_id are not strictly necessary, so they need prior opt-in consent.

The decisive shift came in 2021. After the Deputy Data Protection Ombudsman ruled in May 2020 that telling users to manage their browser privacy settings is not sufficiently active and explicit consent, Traficom and the Office of the Data Protection Ombudsman jointly issued revised cookie guidance for service providers. The headline points:

• Consent must be an active, affirmative action — no pre-ticked boxes, no implied consent.
• Non-essential cookies may not be set before that consent is given.
• Rejecting cookies must be as easy as accepting them.
• Browser-settings “consent” is no longer acceptable.

Finnish courts have since reinforced enforcement of cookie legislation, so this is not guidance that can be safely ignored. It aligns with the EU-wide consensus on reject-all parity and on which framework governs cookies.

Two regulators, two questions

Finland’s split model is worth understanding because it changes who you answer to:

• Traficom (the Finnish Transport and Communications Agency, via its Cyber Security Centre) supervises the storage rule — the §205 question of whether information may be placed on or read from the device at all.
• The Office of the Data Protection Ombudsman supervises the processing — the GDPR question of whether the personal data the cookies collect is handled lawfully, with valid consent and the required disclosures.

A Finnish site needs both correct: a valid storage consent under §205, and a valid GDPR basis and notice for what follows.

Accessibility: Act 306/2019 and the EAA

The Act on the Provision of Digital Services (306/2019) has required accessibility from public-sector and certain publicly-funded and essential services since 2019, measured against EN 301 549 — in practice WCAG 2.1 Level A and AA. The European Accessibility Act then extended accessibility obligations to a wide range of consumer-facing private products and services from 28 June 2025. Notably, Finland implemented the EAA largely by amending existing legislation (including Act 306/2019) rather than enacting a single new statute.

The supervising authority for digital accessibility is the Regional State Administrative Agency for Southern Finland (Etelä-Suomen aluehallintovirasto), which can enforce requirements including through conditional fines under the Threatened Fines Act (1113/1990).

A practical checklist for a Finnish site

1. No non-essential cookie, pixel or storage write fires before active consent.
2. Consent is by affirmative action — not browser settings, not pre-ticked boxes.
3. Reject is as easy and prominent as Accept.
4. A privacy notice names the trackers and the GDPR legal basis for processing.
5. The site meets WCAG 2.1 AA (EN 301 549) for consumer-facing content.

How Veracly checks a Finnish website

Veracly evaluates a Finnish URL against all three frameworks in one scan. The cookie module captures every request, cookie and storage write before banner interaction and flags storage-consent failures (pre-consent firing, browser-settings reliance, no equal reject path). The accessibility module runs axe-core against the rendered DOM for WCAG 2.1 AA. Every finding is reproducible by you in your own browser’s DevTools and is mapped to the framework it engages.

See also: Website compliance in the Netherlands · Auditing a site across multiple jurisdictions · The EAA for small and medium businesses