Consumer Protection and E‑Commerce in Norway · BusinessNorway.ai

Introduction

Norway is one of Europe’s most advanced digital economies and has adopted a consumer‑protection regime that combines general European Union (EU) directives with Norwegian‑specific rules and enforcement powers. As a member of the European Economic Area (EEA) and the European Free Trade Association (EFTA), Norway implements EU consumer directives but retains freedom to adopt stricter national legislation. The result is a multilayered framework that regulates distance selling (online, telephone and door‑to‑door), subscription services, marketing practices, privacy, digital content and platforms. Foreign companies selling to Norwegian consumers must comply with these laws because they are enforced extraterritorially: they apply whenever goods or services are offered to people in Norway or their behaviour is monitored from abroad. Failure to comply can lead to administrative penalties from the Norwegian Consumer Authority (Forbrukertilsynet), the Communications Authority (Nkom) or the Data Protection Authority (Datatilsynet), and to reputational damage. This report synthesizes the main legal instruments, explains how they affect online sales, returns, marketing, subscriptions, consumer rights, privacy and platform compliance, and provides practical guidance for Norwegian and foreign e‑commerce operators.

Legal framework

Key statutes and regulations

Right of Withdrawal Act (Angrerettloven) – Implements the EU Consumer Rights Directive and grants consumers a 14‑day “cooling‑off” period for distance and off‑premises contracts. It requires traders to provide pre‑contract information and a withdrawal form, and regulates returns and refunds. The Act is enforced by the Consumer Authority and the standard form is available in Norwegian and English.
Consumer Purchases Act (Forbrukerkjøpsloven) – Governs the sale of goods to consumers. It establishes rules on delivery, risk transfer, defects, delays, remedies, complaints and guarantees. It distinguishes between goods purchased from traders and those purchased from private individuals and is mandatory law in the consumer’s favour.
Marketing Control Act (Markedsføringsloven) – Regulates marketing practices, unfair commercial practices and standard contract terms. It prohibits misleading, aggressive or otherwise unfair marketing, bans hidden advertising and unreasonable contract terms, and contains special rules for marketing to children. It is enforced by the Consumer Authority which can order cessation and issue fines.
Digital Content and Services Act (Digitalytelsesloven) – Implemented on 1 January 2023 to transpose the EU Digital Content Directive. It applies to contracts where traders provide digital content or digital services to consumers for remuneration, including situations where the consumer pays with personal data. The Act introduces mandatory update obligations, limits on commitment periods and subscription terms, and remedies for non‑conforming digital content.
Electronic Communications Act (E‑Com Act) and Electronic Communications Regulations (Ekomforskriften) – These rules implement the EU ePrivacy Directive and regulate electronic communications, including the use of cookies and online tracking. The 2025 amendments require explicit and active consent for non‑essential cookies, a visible reject button and clear information about data collection.
Personal Data Act (Personopplysningsloven) – Incorporates the EU General Data Protection Regulation (GDPR) into Norwegian law. It sets out the lawful bases for processing personal data, data subject rights and obligations of data controllers and processors. The Act applies to any business that offers goods or services to individuals in Norway or monitors their behaviour, even if the business is not established in Norway.
Marketing Regulation (Forskrift om urimelige handelspraksiser) – Supplements the Marketing Control Act and implements the EU Unfair Commercial Practices Directive. It provides lists of practices that are always prohibited, such as false claims of limited availability, and requires traders to be clear about commercial intent.
Transparency Act (Åpenhetsloven) – Effective from 1 July 2022, this law requires larger enterprises (including foreign companies offering goods or services in Norway and liable to tax there) to conduct human‑rights due diligence, map risks in their supply chains and respond to information requests from any person within three weeks. Non‑compliance can lead to enforcement by the Consumer Authority.
Digital Services Act (DSA) and Digital Markets Act (DMA) – EU regulations that became applicable to EEA countries in 2024. The DSA harmonises rules for the removal of illegal content, bans targeted advertising aimed at children and prohibits manipulative practices that mislead consumers. The DMA regulates large “gatekeeper” platforms, prohibiting self‑preferencing and mandating fair access. Although enacted at EU level, Norway is aligning its national framework with these acts.
Other rules – Specific areas such as financial services, food marketing to children, gambling and healthcare services are subject to additional sectoral legislation. The Norwegian Media Authority also issues guidelines on influencer marketing and discloses partnership rules, while the Accessibility Act ensures that digital services are accessible to all users.

Enforcement landscape

The Norwegian Consumer Authority (Forbrukertilsynet) supervises unfair practices and marketing, including digital subscriptions, loyalty programmes, influencer advertising and price promotions. It can issue administrative decisions, impose daily fines, and take cases to the Norwegian Market Council (Markedsrådet). The Communications Authority (Nkom) monitors compliance with the E‑Com Act, including cookie consent requirements. Datatilsynet (Data Protection Authority) supervises the Personal Data Act and can impose fines of up to 4 % of global turnover for serious GDPR breaches. The Transparency Act is also enforced by the Consumer Authority, adding human‑rights due‑diligence duties to the consumer-protection ecosystem.

Online sales and returns

Right of withdrawal (Angrerett)

Norwegian consumers enjoy a broad right to withdraw from distance and off‑premises contracts. According to the Consumer Council (Forbrukerrådet), the right applies when purchases are made over the internet or via telephone or when goods are purchased outside a fixed retail location (such as at home or on the street) for more than NOK 300. The right does not apply to purchases from private individuals. Consumers may open the packaging and examine the product, but if the examination is excessive or the item is damaged, the trader can reduce the refund. Certain goods and services are excluded, including real estate, passenger transport, tailor‑made products, perishable goods, goods that cannot be returned such as fuel spread on a garden, sealed media or intimate products once opened, hotel stays, performances, and urgent repair services.

How to exercise the right

The consumer must notify the trader within 14 days of receiving the goods or concluding a service contract. If the seller fails to provide the required withdrawal form and information, the withdrawal period is extended to 12 months. For life insurance or personal pension agreements, the period is 30 days. After notification, the consumer has 14 days to return the goods, bearing responsibility for safe return and covering return shipping if the seller has informed them of this cost in advance. However, if the goods were delivered to the consumer’s home and cannot be sent by post, the seller must bear the return cost. The seller must refund the purchase price and original delivery cost (excluding supplementary services) within 14 days of receiving the withdrawal notice, using the same payment method unless otherwise agreed.

Right of withdrawal for services

Consumers may agree that a service (such as a mobile subscription) begins before the 14‑day period expires. In such cases, if the consumer withdraws, the trader may charge for the value of what has been delivered up to the point of withdrawal. For digital content or digital services delivered instantaneously (e.g., downloads or streaming), the right of withdrawal is forfeited once the consumer expressly consents to immediate delivery and acknowledges losing the right. The Digital Content and Services Act ensures that traders must obtain explicit consent before such delivery; they cannot rely on pre‑ticked boxes.

Warranties and complaints (Consumer Purchases Act)

Norway’s Consumer Purchases Act gives consumers strong rights when goods are defective or not as described. The Consumer Council notes that consumers can complain about a faulty product for up to five years after purchase, depending on how long the product is meant to last. Sofas and mobile phones are examples of products with a five‑year period, while goods purchased from private individuals are subject to a two‑year complaint period. If a product has a manufacturing fault or does not match the trader’s description, the consumer may demand repair or replacement at the trader’s expense. Traders should not attempt to repair the same fault more than twice; if they cannot remedy the defect, the consumer may request a price reduction or refund.

Products sold “as seen” or “as is” provide fewer rights, but traders must still disclose defects and meet expectations. Consumers may also rely on any additional product warranty offered by the retailer, but the law’s statutory rights always apply. If a dispute arises, consumers can complain to the Consumer Authority or relevant complaints boards.

Information duties and contract formation

Before concluding a distance contract, traders must provide clear information about the main characteristics of the goods or services, the total price (including taxes and shipping), payment and delivery terms, the right of withdrawal, the seller’s identity and contact details, and complaint procedures. The information must be provided in a durable medium (email or paper). If the trader fails to provide mandatory information or the withdrawal form, the cooling‑off period is extended. Contracts concluded through electronic means must also make it clear when an order is placed and allow the consumer to correct errors before submission.

Payment methods and surcharges

Under the Financial Contracts Act, merchants cannot apply surcharges for the use of debit or credit cards unless they correspond to the merchant’s actual cost and are explicitly disclosed. “Buy now, pay later” solutions are subject to strict marketing and information rules because they are credit products. Payment service providers must be licensed, and foreign operators require a payment institution passport within the EEA.

Marketing and advertising rules

The Marketing Control Act embodies a wide prohibition of unfair practices. It stipulates that marketing must not conflict with good marketing practice, which requires respect for consumers’ interests and general ethical norms. It prohibits:

Unfair commercial practices: any practice that significantly impairs consumers’ ability to make an informed decision and causes or is likely to cause them to take a transactional decision they would not otherwise have taken. This includes aggressive or coercive tactics.
Misleading marketing: providing incorrect information about a product’s characteristics or price, omitting important information, or presenting time‑limited offers that are continually extended. Misleading price comparisons and exaggerated savings are also banned.
Aggressive marketing: marketing involving harassment, coercion, physical force or undue influence.
Protection of children: direct purchase appeals to children are forbidden. Advertising must not exploit children’s natural credulity, loyalty or lack of experience. Norway also has specific regulations banning marketing of unhealthy food to children under 18 on TV and digital media.
Unreasonable contract terms: standard contract terms must not be unreasonably imbalanced. Unlawful clauses may be struck down by courts or the Consumer Authority.
Price information requirements: price information must be clear, accurate and include all costs, including fees and shipping. Hidden advertising is prohibited, and marketing must clearly appear as advertising.
Documentation and environmental claims: traders must substantiate claims in marketing, including environmental claims, with evidence. This precludes greenwashing. Financial and credit advertisements must comply with the Financial Agreements Act and state the effective interest rate.

Marketing through electronic communications (email, SMS, telephone calls) requires prior consent unless the consumer has purchased similar goods and been given an easy opt‑out. The Marketing Regulation lists practices that are always considered unfair (e.g., false claims of a prize, creating a false sense of urgency).

Subscription services and digital content

Digital Content and Services Act

The Digital Content and Services Act (Digitalytelsesloven) transposed EU Directive 2019/770 and came into force on 1 January 2023. It has broad scope: it applies to all enterprises supplying digital content or digital services for remuneration, including where the consumer pays with personal data. “Digital content” means data produced and supplied in digital form, while “digital service” includes services allowing consumers to create, process, store, access or share data, such as apps, streaming services and online games. Exceptions include healthcare services, gambling, performances, number‑independent communication services and financial services. Key obligations and rights include:

Quality and updates: suppliers must provide the latest version and updates to digital content unless otherwise agreed. If updates are not provided, this may constitute a defect.
Termination and commitment periods: consumers can terminate agreements after six months unless a longer commitment period offers a proportionate benefit. Commitment periods exceeding six months are generally prohibited. For example, if a streaming service offers a discounted annual subscription, it must provide a meaningful discount relative to monthly plans.
Restrictions on billing: traders cannot continue to bill consumers for digital services they no longer use. If a periodic advance payment is agreed and there is no coverage on the due date, the agreement is considered terminated if the consumer does not rectify the situation upon request. Similarly, if the registered payment card is invalid, the contract terminates.
Compensation and remedies: consumers may receive compensation even without financial loss if digital content or services are defective or delivered late. The Act provides a hierarchy of remedies similar to physical goods (repair, replacement, price reduction, cancellation and compensation).
Mandatory nature: the Act is mandatory; contractual terms waiving or limiting consumer rights are invalid, and non‑compliant businesses risk daily fines or larger infringement fees from the Consumer Authority.

Digital Content and Services Act vs Digital Content Directive

While the Act is modelled on the EU Directive, Norway introduced stricter rules on subscription length and termination. Providers must notify consumers of active subscriptions and the right of cancellation at least every six months. Commitment periods exceeding six months are normally invalid unless the consumer receives a proportionate benefit. Consumers may cancel subscriptions with monthly pre‑payments at any time with effect from the next payment period, and failure to issue the six‑month reminder entitles the consumer to terminate without cost. Providers must also implement routines to stop charging consumers who stop using the service.

These rules directly address common “subscription traps” where consumers are locked into lengthy commitments or find it difficult to cancel. The Consumer Authority has been active in enforcing them, for example by investigating streaming services and mobile subscription providers that fail to offer clear cancellation paths.

Marketing of subscriptions

Marketing of subscription services must clearly disclose the total price, commitment period, termination rights and any renewal terms. Free‑trial offers cannot be automatically converted into paid subscriptions without the consumer’s express consent. The Marketing Control Act prohibits misleading time‑limited offers and automatically extended promotions. Influencers promoting subscription services must identify commercial content and disclose any financial relationship with the advertiser. The Consumer Authority provides guidelines on influencer marketing and has fined social‑media personalities for failing to mark advertisements.

Privacy and data protection

Applicability and jurisdiction

The Personal Data Act (2023) implements the GDPR and applies to any business that processes personal data in connection with offering goods or services to individuals in Norway or monitoring their behaviour, regardless of where the business is established. Even companies operating outside Norway are subject to the Act if they process data about Norwegian residents via websites, apps or cookies. The law adopts the GDPR’s definitions of personal data and sensitive personal data (e.g., racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health and sex life).

Processing personal data must have a lawful basis. Consent is one possible basis but not the only one; processing is also lawful if necessary to perform a contract, comply with a legal obligation, or pursue the controller’s legitimate interests provided they do not override the interests or rights of the data subject. Consent must be freely given, specific, informed and unambiguous, and pre‑ticked boxes are invalid. Under the E‑Com Act, websites must obtain explicit consent before storing or accessing non‑essential cookies or tracking technologies. Users must have an equally accessible “reject” option and be able to withdraw or modify consent at any time.

Data subject rights

The GDPR grants data subjects a suite of rights, including the right to information, access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability and objection to processing. The Personal Data Act adds minor national variations but generally mirrors these rights. Businesses must provide a privacy policy explaining how personal data are collected, used, stored and shared, and must respond to data subject requests within one month. International data transfers require appropriate safeguards such as Standard Contractual Clauses or adequacy decisions. Violations can lead to fines up to 4 % of global turnover or NOK 20 million, whichever is higher.

Cookies and tracking

The E‑Com Act introduces strict cookie consent rules. Businesses processing Norwegian users’ data must provide:

Explicit user consent before placing non‑essential cookies.
Equally accessible “reject” option alongside the “accept” button.
Clear and transparent information about what cookies do, why they are used and who has access to the data.
Easy withdrawal and modification of consent at any time.
Consent logs to demonstrate compliance during audits.

These obligations apply to any website or app targeting Norwegian users, including foreign e‑commerce sites. Non‑compliance can lead to fines of up to 4 % of global annual revenue.

Platform compliance and European digital regulations

Digital Services Act (DSA)

The DSA, applicable in the EEA since February 2024, imposes horizontal obligations on digital service providers. Key elements relevant to e‑commerce include:

Removal of illegal content: platforms must implement mechanisms to remove illegal content (e.g., counterfeit goods, illegal products, hate speech) and cooperate with authorities.
Transparency: providers must explain algorithms that recommend content and display advertising, and they must report on content moderation practices.
Ban on targeted advertising at children and sensitive‑data‑based targeting: the DSA prohibits targeted advertising aimed at minors and based on sensitive categories such as religion, gender, race or political opinions.
Prohibition of dark patterns: the DSA bans user‑interface designs that mislead users into giving more personal data or making unintended purchases.
Very Large Online Platforms (VLOPs): platforms reaching at least 10 % of EU users face extra obligations, including risk assessments and supervisory fees.

Digital Markets Act (DMA)

The DMA targets “gatekeeper” platforms that have significant impact on the internal market. It prohibits self‑preferencing, tying and other practices that unfairly disadvantage competitors, and it requires interoperability of messaging services and data portability. Gatekeepers designated by the European Commission must comply with obligations and prohibitions since March 2024. The DMA applies to EEA states, meaning Norwegian authorities will monitor compliance for services offered to Norwegian users.

Artificial Intelligence Act (AI Act)

The EU AI Act, enacted in July 2024 and expected to be fully applicable by August 2026, adopts a risk‑based approach to regulating AI systems. High‑risk systems (including those used in employment, education or law enforcement) require conformity assessments and human oversight. Norway plans to implement the AI Act under its EEA obligations and launched consultations on its own AI Act in early 2025. E‑commerce operators deploying recommendation algorithms or chatbots should monitor AI‑act requirements, especially regarding transparency, data governance and human oversight.

Supply‑chain transparency and sustainability

The Transparency Act requires large enterprises (both domestic and foreign) that offer goods or services in Norway to map and assess human‑rights and decent‑working‑conditions risks across their supply chain. Companies must embed responsible business conduct into policies, map risks, cease or mitigate adverse impacts, track implementation and results, and publish an annual due‑diligence statement by 30 June. They must respond to information requests from any person within three weeks, meaning consumers can inquire about production conditions and expect a transparent response. While not specifically a consumer‑protection law, the Transparency Act reflects Norwegian expectations for ethical supply chains and influences marketing (e.g., claims about fair trade or sustainable sourcing must be documented). Non‑compliance can lead to enforcement penalties.

Actionable guidance for businesses

General compliance roadmap

Assess your offer and identify applicable laws. Map whether your business supplies physical goods, digital content, digital services or subscription services, and whether it processes personal data from Norwegian consumers. Determine whether you are subject to the Transparency Act (typically if your annual turnover exceeds NOK 70 million or you meet other thresholds).
Provide clear pre‑contract information. Ensure that online listings describe the product or service accurately, specify total price (including taxes and shipping), payment methods, delivery time, and the right of withdrawal. Include your company’s name, address, organization number, and contact details. Provide the withdrawal form and instructions electronically.
Implement a robust withdrawal and return process. Set up customer support channels to receive withdrawal notices within 14 days. Provide a simple online cancellation form or email address. Once you receive a withdrawal notice, refund within 14 days and instruct the consumer how to return goods. Bear return costs for items that cannot be shipped by post or if you failed to inform the consumer about return costs.
Offer complaint handling and warranty support. Train customer service to handle warranty claims for up to five years for products meant to last longer, and two years for private‑sale goods. Provide repairs, replacements or refunds promptly, and avoid multiple failed repair attempts.
Review marketing practices. Audit all marketing materials (websites, ads, social‑media posts, influencer collaborations) to ensure they are truthful, not aggressive and comply with good marketing practice. Avoid false claims of scarcity or time pressure. Disclose any commercial relationships with influencers or affiliates.
Protect children and vulnerable consumers. Avoid direct purchase appeals to children and do not market harmful products (unhealthy foods, gambling) to minors. Follow specific advertising bans set by sectoral regulations.
Evaluate subscription terms. Limit commitment periods to six months unless a proportionate benefit is offered. Provide consumers with easy cancellation mechanisms and send six‑month reminders of active subscriptions and cancellation rights. Stop charging consumers who cease using the service and treat non‑payment as termination.
Comply with digital content obligations. Provide updates and maintain digital content quality. Offer remedies (repair, replacement or price reduction) if digital content is defective or not delivered on time. Recognise that consumers can receive compensation without proving financial loss.
Implement privacy and cookie compliance. Publish a GDPR‑compliant privacy policy detailing data collection and usage. Obtain explicit consent for non‑essential cookies with an equally accessible reject option and allow users to change preferences at any time. Record consent logs and be prepared for audits. Use data processing agreements with vendors and ensure appropriate safeguards for international transfers.
Monitor EU digital regulations. Large platforms should prepare for DSA and DMA compliance: implement mechanisms to remove illegal content; review algorithms to avoid discrimination; and ensure no self‑preferencing or unfair restrictions. All providers should avoid targeted advertising at children or based on sensitive data.
Address supply‑chain transparency. If subject to the Transparency Act, embed due‑diligence processes, map supply chains, and publish annual statements. Respond to information requests within three weeks and ensure marketing claims about sustainability are backed by documentation.
Prepare for enforcement and penalties. Violations can lead to daily coercive fines from the Consumer Authority, large infringement fees, and reputational damage. Non‑compliance with the E‑Com Act can result in fines up to 4 % of global turnover or €20 million, and GDPR breaches carry similar penalties. Frequent checks by authorities mean proactive compliance is essential.

Additional considerations for foreign businesses

Norwegian language and localisation. Provide information and customer support in Norwegian; while English may be used, Norwegian consumers may not be deemed to have consented to English‑only terms. The Consumer Authority often requires marketing and contract terms to be in a language the consumer understands.
Norwegian domain and presence. Using a .no domain or marketing specifically to Norwegian consumers can strengthen the case that Norwegian law applies. Even if your business is established abroad, offering services to Norwegian consumers triggers Norwegian consumer law.
VAT and customs. From 2023, Norway requires foreign e‑commerce sellers to register for VAT on low‑value goods (VOEC scheme). Provide transparent pricing inclusive of VAT and handle customs declarations.
Distance selling cross‑border disputes. Consumers can file complaints through the European Consumer Centres Network, and you may have to respond to cross‑border dispute resolution mechanisms. Ensure your terms designate Norwegian or EU law where applicable and be prepared to handle multi‑jurisdictional complaints.
Accessibility requirements. Public‑sector websites and many private services must comply with accessibility standards (WCAG 2.1). An Accessibility Act enforcement from 2025 will extend these requirements to most digital services, requiring alt‑text, keyboard navigation and captioning.
Artificial intelligence and automated decision making. If your platform uses AI to personalise offers or pricing, ensure compliance with the upcoming AI Act, including risk assessments and transparency obligations. Avoid discriminatory pricing based on sensitive data and be prepared to explain algorithms to regulators.

Conclusion

Consumer protection and e‑commerce regulation in Norway form a sophisticated and evolving ecosystem. Distance sellers must respect the 14‑day right of withdrawal, provide comprehensive pre‑contract information and handle returns fairly. They must support complaints and warranty claims for up to five years. Marketers must avoid misleading or aggressive practices, clearly label advertisements and protect children. Subscription services face strict rules on commitment periods, mandatory updates and reminders, and must not trap consumers in long contracts. Privacy and cookie consent requirements demand explicit, informed consent and respect for data subject rights. Digital platforms are now subject to European DSA and DMA obligations that ban targeted advertising to children and require fair competition. The Transparency Act extends consumer expectations to the supply chain, requiring large firms to map and disclose human‑rights risks.

For businesses, compliance is not merely a legal obligation but a strategic advantage. Norwegian consumers are sophisticated and value transparency, sustainability and ethical behaviour. Building trust through clear communication, responsive customer service, ethical marketing and robust data protection will not only avoid fines but also enhance brand reputation and customer loyalty in Norway’s mature e‑commerce market.

Sources

Forbrukerrådet – “Når kan du bruke angreretten?” – explains when the right of withdrawal applies to internet and telephone sales, states that consumers have a 14‑day withdrawal period, lists exceptions (real estate, travel, custom goods, perishable items, sealed media), and describes how to exercise the right including notifying the seller within 14 days, the need to return goods within 14 days after notification, and who pays return costs.
Forbrukerrådet – “Cause for complaint?” – states that consumers may complain about a faulty product for up to five years depending on product life, with a two‑year period for purchases from private individuals; explains that traders must repair or replace faulty goods and may need to refund or reduce the price if repair fails.
Altinn – “What rules apply when marketing goods to consumers” – summarises the Marketing Control Act: marketing must follow good marketing practice; unfair, misleading or aggressive marketing is prohibited; price information must be clear and include all costs; hidden advertising and unreasonable contract terms are banned; environmental claims must be documented.
Hjort law firm – “Important legislative changes impact digital service providers in 2023” – summarises the Digital Content and Services Act: commitment periods exceeding six months are normally not permitted; consumers can cancel subscriptions at any time with effect from the next payment period; providers must notify consumers of active subscriptions every six months; non‑payment may be interpreted as termination; and the Act extends beyond the EU Directive.
BAHR law firm – “The Norwegian Act relating to digital consumer purchases came into force 1 January 2023” – explains that the Act applies to all enterprises supplying digital content or services for remuneration (including payment with personal data), obligates suppliers to provide updates, allows consumers to terminate after six months unless a proportionate benefit is offered, restricts billing for unused services, and provides compensation for defects even without financial loss.
CookieHub – “Norway E‑Com Act Cookie Consent and Compliance” – describes the E‑Com Act’s requirements: explicit user consent and a visible reject button for non‑essential cookies; clear information on cookies; easy consent withdrawal; consent logs; fines up to 4 % of global turnover; and consumer rights such as granular consent and the ability to modify consent at any time.
Secure Privacy – “Norwegian Data Protection Act: A Guide to Personal Data Processing in Norway” – explains that the Personal Data Act implements the GDPR, defines personal and sensitive data, and applies to any business offering goods or services to individuals in Norway or monitoring their behaviour. It outlines lawful bases for processing, the distinction between data controllers and processors, and the requirement to obtain consent or rely on other legal bases.
Trade.gov – “Norway eCommerce” – summarises the EU Digital Markets Act and Digital Services Act as applicable to Norway: the DMA regulates large gatekeeper platforms and prohibits self‑preferencing; the DSA harmonises mechanisms for removing illegal content, bans targeted advertising at children and based on sensitive data, and prohibits dark patterns.
Sedex – “Norwegian Transparency Act: Key Requirements” – explains that the Transparency Act requires larger enterprises (including foreign companies liable to tax in Norway) to conduct human rights due diligence, map supply‑chain risks, implement mitigation measures, publish annual statements and respond to information requests within three weeks.