GDPR Fines in Norway 2026: Lessons for Online Stores
The Norwegian Data Protection Authority has tightened enforcement. We review the latest fines and what Norwegian online stores must watch out for.
August 28, 2026 · Stradenova
The Norwegian Data Protection Authority (Datatilsynet) has in 2026 increased both the number of inspections and the size of penalties against Norwegian businesses. For online stores, the message is clear: privacy is not something you can ignore. Here are the most important cases and lessons.
The Biggest Cases in 2026
Online Store Fined for Illegal Tracking Pixels
A mid-sized Norwegian online store received a NOK 2.8 million fine for implementing Meta Pixel and Google Analytics without valid consent. The store used a cookie banner that pre-checked tracking options – which is not valid consent under GDPR.
Lesson: Your consent banner must require active action from the user. No pre-checked boxes, and “Accept all” cannot be visually emphasized over “Reject.”
Fine for Missing Data Processing Agreement
An online store using a foreign email marketing service without a data processing agreement received a NOK 1.2 million fine. Customers’ email addresses, names, and purchase history were transferred to a third party outside the EU without a legal basis.
Lesson: Every single service that processes customer data on your behalf needs a data processing agreement. This applies to email tools, analytics tools, CRM, shipping partners, and payment solutions.
Penalty for Failure to Delete
An online store had stored customer data for over 7 years after the last purchase, including payment information. The fine was NOK 800,000.
Lesson: Have a clear deletion policy. Customer data should be deleted or anonymized after a reasonable period – typically 3 years after the last transaction for marketing purposes, and after the statutory retention period for accounting data (5 years).
Checklist for Norwegian Online Stores
Consent and Cookies
- Cookie banner requires active opt-in for tracking cookies
- No tracking scripts load before consent is given
- Users can easily withdraw consent
- Consent choices are logged with timestamps
- Google Consent Mode v2 is correctly implemented
Privacy Policy
- Updated privacy policy covering all data processing
- Clear information about rights (access, deletion, data portability)
- Contact information for the data protection officer or responsible person
- List of third parties receiving data
Data Processing Agreements
- Agreement with all third parties processing customer data
- Transfers to countries outside EU/EEA are covered (SCCs or other basis)
- Agreements are up-to-date and accessible
Technical Measures
- Encryption of customer data in transit (HTTPS) and at rest
- Access control – only those who need it have access to customer data
- Automatic deletion of inactive customer accounts
- Logging of data access for audit purposes
Rights
- Process for handling access requests (maximum 30 days)
- Ability for customers to download their data (data portability)
- Process for deleting customer data on request
- Documented process for handling data breaches (72-hour notification)
Google Analytics and Norwegian Online Stores
Following the Data Protection Authority’s statements on Google Analytics, Norwegian online stores should be particularly attentive:
- GA4 with consent mode: Implement Google Consent Mode v2 so GA4 only collects full data when consent is given
- Server-side tagging: Consider server-side GTM to have better control over what data is sent to Google
- Alternatives: Plausible, Fathom, and Matomo are GDPR-friendly alternatives that do not require consent for basic analytics
The Cost of Non-Compliance
With fines ranging from NOK 800,000 to NOK 2.8 million for Norwegian online stores in 2026 alone, it is obvious that GDPR compliance is cheaper than the breach. A thorough GDPR review typically costs NOK 30,000–80,000 – a fraction of a potential fine.