Cybersecurity Policy Report, Websites Sanctioned for Improper Use of Tracking Pixels in Norway, (Jun 13, 2025)

By Tony Foley

Datatilsynet, Norway’s data protection authority, has completed an investigation resulting in the issuance of sanctions against six websites for their improper use of tracking pixels.

Tracking pixels are a technology that automatically passes information about visitors to a website or app to a third party, including information about which websites people visit, what actions they take, and what items they place in online shopping carts.

In a news release yesterday announcing the sanctions, Datatilsynet said all of the websites investigated made personal data acquired through the use of tracking pixels available to third parties without a legal basis in violation of the European Union’s General Data Protection Regulation (GDPR). In addition, the agency’s investigation found that the websites violated their duty to inform, shared sensitive information that could indirectly disclose clues about visitors’ health, sex life, and religion and, in at least one case, shared personal data about children in vulnerable situations. The cases also revealed further practices not in line with data protection requirements, including visitors being incorrectly informed that they were anonymous when they were not, illegal disclosure of special category data to third parties, and visitors being “nudged” into consenting or receiving information that was misleading, difficult to understand or did not explain the consequence of giving consent.

“Everyone should be able to use the Internet and find information, without being afraid of private information going astray,” said Minister of Digitalisation and Public Administration Karianne Tung. “I am therefore pleased that [Datatilsynet] supervises the use of tracking tools and what information is shared with the large technology companies."

In the case of the website 116111.no, the site providing public services for children in vulnerable situations in the Kristiansand municipality, Datatilsynet imposed an infringement fine of 250,000 Norwegian kroner ($25,250), based primarily on its status as a public website that processed children’s data illegally. Because the purpose of the investigations was to raise awareness on the use of tracking pixels, however, Datatilsynet decided only to issue reprimands to the other sites.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR