Finland’s Supreme Administrative Court issued two significant precedent-setting rulings in late August concerning cookies and user consent. The rulings clarify when user consent is required for cookies and similar technologies that are not strictly necessary to provide a service, as well as how that consent must be requested. For publishers, the decisions could mean changes to both cookie practices and advertising sales.
What did the Supreme Administrative Court rule?
-
Users must not be steered towards accepting cookies by making it harder to reject them: in its first ruling the Supreme Administrative Court addressed the requirement that consent must be freely given. In the case in question, users could accept cookies directly on the first layer of the cookie banner, but rejecting them required navigating to the settings. The Court found that this design unduly influenced users’ freedom of choice, as giving consent was significantly easier than refusing it.
- Personalisation and analytics generally require consent: In its second ruling the Court clarified when cookies and other technologies can be considered strictly necessary for providing a service. Cookies used to personalise a news service and analyse user activity could not be considered necessary simply because they improved the user experience or helped develop the service. Their use therefore generally requires user consent. The Court also confirmed that consent requirements may apply to network requests if they involve accessing information stored on a user’s device. The decisive factor is not the technology used, but whether information stored on the device is accessed and whether that access is strictly necessary.
What does this mean for advertising sales?
One of the most interesting questions is how these changes will affect advertising sales. If a larger proportion of users reject cookies, the amount of data available for advertising may decrease. This could affect targeting, measurement and, ultimately, advertising revenue. At the same time, consent-or-pay models may become an increasingly interesting option for Finnish publishers. Iltalehti introduced the model in 2025. Users can either accept cookies or pay a monthly fee to access the service without cookies used for ad targeting Helsingin Sanomat has now also announced that it will introduce a model in October under which rejecting cookies will become a paid option..
It will be interesting to see how many Finnish publishers follow suit. Consent or pay offers one possible way to balance users’ freedom of choice with the business model of advertising-funded media at a time when consent rates may decline. We are also likely to see different variations of consent-or-pay models, alongside more communication aimed at helping audiences understand the role cookies play in funding independent media.
What should publishers do now?
There is no need to rush into changes, but publishers should review their current consent management practices and identify any potential need for updates. It is also worth assessing how possible changes in consent rates could affect the monetisation of their services. In addition, publishers should keep an eye on how consent-or-pay models develop in Finland and what can be learned from different implementations. Gravito CMP, which is used by many Relevant Digital publisher customers, also supports consent-or-pay solutions. Publishers interested in exploring this approach can therefore test the model using their existing CMP solution.
The regulatory landscape continues to evolve as well. The EU’s proposed Digital Omnibus package includes discussions on new approaches to consent management, among other topics. For publishers, the environment surrounding cookies and consent therefore remains in a state of change.