Home › What can it cost to get this wrong?
What can it cost to get this wrong?
Below is what we know, with sources. These are decisions in other cases, not an assessment of you or your website. An automated test does not establish a breach of law either.
What the law requires
The requirement concerns consent. Before a website stores or reads information on your device (such as cookies), the main rule in the EU/EEA is that information and valid consent are required (ePrivacy Directive and GDPR; in Norway: Electronic Communications Act § 3-15). The two legal exceptions are narrow: technology that only transmits communication, or that is strictly necessary for a service you have explicitly requested. If a site uses analytics or advertising, it therefore needs a consent solution in practice. Consent must be freely given, specific, informed, unambiguous, documentable, and as easy to refuse or withdraw as to give. Regulators supervise this.
Norwegian Electronic Communications Act, section 3-15 (Lovdata) · Norwegian Data Protection Authority: cookies
Decisions in other cases
- Section 11-3 of the Norwegian Electronic Communications Regulations allows administrative fines of up to 5% of a company’s annual turnover. This is a ceiling, not a typical fine. Lovdata
- On 10 June 2025 the Norwegian Data Protection Authority fined the municipality of Kristiansand NOK 250,000.00 for unlawfully sharing children’s personal data through tracking pixels. Five other websites were reprimanded in the same inspection. The case was decided under the data protection rules, not the fine provision in the ecom regulation, so it was not a fine merely for a missing box. An automated CookieHawk test does not establish a breach, the content of data or a legal basis. Datatilsynet
- The Norwegian Data Protection Authority writes that reactions in the future may be much stricter. Datatilsynet
The most common problem we see
A box is installed, but tracking continues after the visitor has clicked “Reject all”. The cause is usually a script hard-coded in the page or in Tag Manager without being tied to consent. It looks right on screen, and the fault stays until someone actually tests what the browser does.
What we do
We document what the website does. Read about the test method, banner features and fixes included in plans.
We are not lawyers, and a test is not a legal approval. The report shows what the website actually did, not whether the law was followed. Some things no box can stop, for example tracking that runs through the website’s own server.
What happens during an inspection?
Use the test report and export from activated consent logging as technical records: timestamps, received choices and observed requests. These do not constitute legal approval, legal representation or coverage of fines.