Website compliance in Finland: cookies, GDPR and accessibility

Finland applies the same EU rules as the rest of the union — GDPR for personal data, ePrivacy for cookies and storage, and the European Accessibility Act for accessibility — but its implementation has two distinctive features: cookie oversight is split between two regulators, and Finland was one of the last EU member states to abandon “consent” by browser settings. This guide maps the three frameworks as they apply to a Finnish website in 2026.

The three frameworks that apply

• GDPR + Tietosuojalaki. The GDPR applies directly, supplemented by the Finnish Data Protection Act (Tietosuojalaki, 1050/2018). The regulator is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu).
• ePrivacy via the Act on Electronic Communications Services. The cookie-storage rule is Section 205 of Act 917/2014, supervised by Traficom.
• EAA via the Act on the Provision of Digital Services. The European Accessibility Act was implemented through amendments to existing laws, including Act 306/2019, in scope from 28 June 2025.

Cookies: Section 205 and active consent

Under Section 205 of the Act on Electronic Communications Services, storing or reading information on a user’s terminal equipment requires consent unless the storage is strictly necessary to deliver the service the user requested. Analytics cookies such as _ga or _pk_id are not strictly necessary, so they need prior opt-in consent.

Finland arrived at that position late. Traficom continued to accept browser settings as a way of expressing consent even after the Court of Justice decided Planet49 (C-673/17) on 1 October 2019, leaving Finland one of the last holdouts in the EU. The position turned on the Deputy Data Protection Ombudsman’s decision of 14 May 2020, which held that telling users to manage their browser privacy settings is not sufficiently active and explicit consent; Traficom and the Office of the Data Protection Ombudsman then jointly issued revised cookie guidance on 13 September 2021. The headline points:

• Consent must be an active, affirmative action — no pre-ticked boxes, no implied consent.
• Non-essential cookies may not be set before that consent is given.
• Rejecting cookies must be as easy as accepting them.
• Browser-settings “consent” is no longer acceptable.

Finnish courts have since reinforced enforcement of cookie legislation, so this is not guidance that can be safely ignored. It aligns with the EU-wide consensus on reject-all parity and on which framework governs cookies.

Two regulators, two questions

Finland’s split model is worth understanding because it changes who you answer to:

• Traficom (the Finnish Transport and Communications Agency, via its Cyber Security Centre) supervises the storage rule — the §205 question of whether information may be placed on or read from the device at all.
• The Office of the Data Protection Ombudsman supervises the processing — the GDPR question of whether the personal data the cookies collect is handled lawfully, with valid consent and the required disclosures.

A Finnish site needs both correct: a valid storage consent under §205, and a valid GDPR basis and notice for what follows.

Accessibility: Act 306/2019 and the EAA

The Act on the Provision of Digital Services (306/2019) has required accessibility from public-sector and certain publicly-funded and essential services since 2019, measured against EN 301 549 — in practice WCAG 2.1 Level A and AA. The European Accessibility Act then extended accessibility obligations to a wide range of consumer-facing private products and services from 28 June 2025. Notably, Finland implemented the EAA largely by amending existing legislation (including Act 306/2019), with a separate act for products — Act 102/2023 on the accessibility requirements of certain products — rather than one consolidated statute.

Do not address this to a Regional State Administrative Agency. Supervision of digital accessibility passed from Etelä-Suomen aluehallintovirasto to Traficom on 1 January 2025, and the Regional State Administrative Agencies were abolished altogether at the end of 2025. That gives Traficom three roles on a Finnish website: cookie storage under §205, digital accessibility under Act 306/2019, and market surveillance for products under Act 102/2023. It can enforce requirements including through conditional fines under the Act on Conditional Fines (uhkasakkolaki, 1113/1990).

A practical checklist for a Finnish site

1. No non-essential cookie, pixel or storage write fires before active consent.
2. Consent is by affirmative action — not browser settings, not pre-ticked boxes.
3. Reject is as easy and prominent as Accept.
4. A privacy notice names the trackers and the GDPR legal basis for processing.
5. The site meets WCAG 2.1 AA (EN 301 549) for consumer-facing content.

How Veracly checks a Finnish website

Veracly evaluates a Finnish URL against all three frameworks in one scan. The cookie module records the third-party requests, cookies and storage writes present before the banner is touched — and it never touches the banner, because clicking one would itself be a consent gesture and would pollute the pre-consent reading. It flags non-essential storage set before consent, a missing banner, a missing or unequal reject path, and pre-ticked consent. Two limits worth stating plainly: we cannot detect reliance on browser settings, because that is a claim in your banner copy rather than an observable runtime behaviour, so a human has to read it; and only requests to other hosts are recorded, so a self-hosted Matomo setting _pk_id from your own domain is invisible to the request log. Reject parity is read from the rendered banner — button kind, visibility, visual weight — not tested by clicking Reject. The accessibility module runs axe-core against the rendered DOM for WCAG 2.1 AA, and tracker findings come with a DevTools recipe you can run yourself.

See also: Website compliance in the Netherlands · Auditing a site across multiple jurisdictions · The EAA for small and medium businesses