You probably pressed “Accept all” today. Do you know what you agreed to?

Section 3-15 of the Norwegian Electronic Communications Act came into force on 1 January 2025. It requires prior consent, valid under the GDPR, before anyone stores or retrieves information from your equipment. The provision is technology-neutral and applies whether or not the information is personal data.

Valid consent must be freely given, specific, informed, unambiguous, given through an affirmative action, demonstrable and as easy to withdraw as it was to give. Most consent banners you encounter fail on at least one of these.

Supervision is split: Nkom assesses whether a technical solution falls under the provision and whether the exemptions apply, while the Data Protection Authority assesses whether the information given is adequate and whether the consent holds up.

When a page with ad space loads, a bid request goes out to a large number of companies at once. It typically contains what you are looking at, roughly where you are, what device you are on and an identifier that follows you onwards.

The Irish Council for Civil Liberties estimated this happens 178 trillion times a year across the United States and Europe combined. Per person that averages 376 times daily in Europe and 747 in the US.

Everyone who receives a bid request gets the data — including those who do not bid. There is no mechanism for taking it back.

The Markup tested the websites of the 100 largest hospitals in the United States in 2022 and found the Meta Pixel on 33 of them. It sent data to Facebook every time someone clicked to book a doctor's appointment.

At seven health systems the pixel sat inside password-protected patient portals, where it collected information about prescriptions, sexual orientation and health conditions.

After the investigation was published, 28 hospitals removed or blocked the pixel — which also means it had been sitting there doing its job until somebody went looking.

A review of the five most widely used consent platforms across the 10,000 most visited UK websites found that only 11.8% of 680 banners examined met the minimum requirements of European law.

The field experiment in the same study showed why the design pays: removing the reject button from the first page increased consent by 22–23 percentage points. Putting granular controls on the first page reduced it by 8–20 percentage points.

The design, then, is not accidental, and it is not the result of poor craftsmanship. It is calibrated.

Schibsted introduced an arrangement under which readers pay 39 kroner a month to avoid personalised advertising, across titles including Aftenposten and VG.

The Norwegian Data Protection Authority questions whether consent is genuinely freely given when the alternative is to pay, and its director Line Coll has said that privacy is a human right one should not have to pay for. The authority has not concluded that the arrangement is unlawful, and has asked the industry to await the European Data Protection Board's work. The Norwegian Consumer Council has lodged a complaint.

In April 2024 the EDPB stated that large online platforms will in most cases be unable to obtain valid consent through a bare choice between consenting and paying, and that an equivalent alternative without behavioural advertising should be offered. The opinion is not binding. The legal position is therefore contested, not settled.

Flock Safety supplies automatic licence plate readers to American police forces. The cameras record which vehicles pass where and when, and searches run across a nationwide network.

An internal audit in Albany, Georgia in July 2026 led to five officers being dismissed and subsequently arrested over searches with no legitimate investigative purpose. A San Francisco audit published on 17 June 2026 found 299 unlawful queries of the city's data over a single year, made by federal and out-of-state agencies.

The Institute for Justice keeps a running count of cases in which officers used such systems to keep tabs on current or former partners. As of 1 August 2026 the count had reached at least 28, with the bulk of them since 2024.