Online safety & content laws in Norway (2026)

After a public consultation on an initial 15-year threshold drew over 8,000 submissions, the Norwegian Government announced it will present a bill to Parliament setting the minimum social media age at 16 (aligning with Australia). Platforms will be responsible for age verification at login; exceptions apply for school-related and communication services.

Norway's Digital Security Act — implementing EU NIS1 Directive 2016/1148 and enacted in December 2023 — entered full force for all covered operators of essential services and relevant digital service providers, ending transitional provisions and triggering mandatory cybersecurity risk management and incident reporting.

Norway's Ministry of Digitalisation circulated a draft law incorporating the EU Digital Services Act into Norwegian law, with Nkom proposed as competent authority and coordinator for digital services. The consultation deadline was October 1, 2025, with DSA obligations expected to apply from summer 2026.

The Norwegian Government sent a draft law for consultation proposing an absolute minimum age of 15 for access to social media platforms, also raising the GDPR consent age to 15. This was Norway's first legislative step to restrict children's access to social media and generated over 8,000 public responses.

A comprehensively revised Electronic Communications Act (adopted 12 November 2024), replacing the 2003 Act and implementing the EU European Electronic Communications Code, entered into force. It extended Nkom's oversight to data centre operators, strengthened cybersecurity obligations for network operators, and tightened cookie-consent requirements.

Parliament enacted the Digital Security Act implementing EU NIS1, establishing mandatory cybersecurity risk management, incident-reporting obligations, and supervisory powers for NSM (the National Security Authority) over operators of essential services such as energy, transport, health, water, and digital infrastructure providers.

The Norwegian Supreme Court ruled that section 185 of the Penal Code provides stronger protection to minors than adults in online contexts, establishing that the same online statement can carry heavier criminal weight when directed at children — a landmark ruling defining the scope of online speech regulation.

Norway's Data Protection Authority imposed its largest-ever GDPR fine (NOK 65 million, ~€5.4 million) on US-based Grindr LLC for sharing users' precise location and sexual orientation with advertising partners without valid legal basis, violating Articles 6(1) and 9(1) GDPR — setting a major precedent for online-platform data practices.

In twin landmark rulings, Norway's Supreme Court upheld criminal convictions under Penal Code section 185 for racist and anti-Muslim comments posted in a 'closed' Facebook group of ~15,000 members, confirming for the first time that ostensibly private social-media spaces constitute 'public' utterance under Norwegian criminal law.

The Norwegian Personal Data Act of 15 June 2018 entered into force on 20 July 2018, incorporating the GDPR by reference through the EEA Agreement and granting Datatilsynet full enforcement powers including fines up to €20 million or 4% of global turnover — the bedrock of online data-processing regulation in Norway.

Norway's new Penal Code (originally adopted 2005) entered full force with section 185 replacing the old section 135a, formally applying hate speech criminal liability to online utterances. A 2012 Ministry of Justice proposal to classify the internet as 'public space' had informed the legislative drafting.

Following Copyright Act amendments enabling rightsholder-initiated court injunctions, Norwegian ISPs began executing DNS-based blocks on piracy sites including The Pirate Bay — Norway's first judicially mandated regime of online content restriction, subsequently expanded to dozens of streaming and torrent portals.

Norway enacted its foundational Electronic Communications Act implementing EU Directive 2002/58/EC on privacy and electronic communications, establishing Nkom as the sector regulator and creating the primary legal framework governing internet service providers, network security, and lawful interception for over two decades.