Kristiansand Municipality – €21,750 Fine (Norway, 2025)

Following media reports about the use of invasive tracking tools on website, DPA investigated www.116111.no. The website is a help line for abused minors operated by the Kristiansand Municipality (the controller). The investigation found 17 cookies on the website along with Meta and Snap pixels. A pixel is a tracking tool attached to the website that directly sends user’s data to its operator. The DPA decided to limit its investigation to the use of the pixels. At the time of the investigation, the controller’s privacy policy did not mention the cookies and the pixels. The privacy policy was later amended to list cookies and tracking pixels more completely. However, the new privacy policy still failed to specify the legal basis for processing personal data, and the categories of data processed via the trackers. The DPA fined the controller 250,000 NOK (€21,600) for processing personal data via the Snap and Meta pixels without a lawful basis. The DPA clarified that it did not issue an injunction to remove the trackers because the controller already did so at the time of the decision. = The DPA fist established that the municipality was a data controller for the pixels as per Article 4(7) GDPR as it operated the website, integrated the tracking tools and determined the purpose of processing (i.e.: to measure the reach of its media campaign). In this regard, the DPA clarified that it was not relevant that the municipality had no access to the data processed via the pixels. On this point, the DPA referred to the Fashion ID ruling of the CJEUCJEU, case C-40/17, Fashion ID, 29 July 2019 (available here).. = Third party pixel collected personal information including unique user IDs, IP addresses, and device fingerprints which could be used as identifiers by Meta and Snap. For this reasons, the DPA held the pixels collected personal data, contrary to what the controller’s privacy policy stated. The DPA then assess whether the controller could rely on a legal basis for processing personal data. Specifically, the DPA held that: * The controller could not rely on consent, because its website did not collect consent; * Commercial tracking is not a public interest covered by Article 6(1)(e) GDPR; * Legitimate interest was not a valid legal basis, because the stated objective of examining the marketing campaign did not outweigh the rights and freedoms of children. With regards to legitimate interest, the DPA further stated that in the case at hand, the controller processed information of a "very private nature" which was close to constituting sensitive data under the GDPR. Sharing these data with third parties had significant privacy implications and could lead to a loss of control over personal data. These considerations were crucial to the DPA’s conclusion that the controller did not correctly balance its interest with those of the data subject. = The controller’s privacy policy did not inform data subjects that the pixels processed their data. In fact, the policy stated that the website only processed anonymous data. For this reason, the DPA held that the controller failed to provide information about the processing of personal data, in breach of Articles 12(1) and 13 GDPR. The controller also noted that the information provided in the policy was not understandable for children. = The DPA issued a fine 250,000 NOK (€21,600). The DPA considered that the controller acted negligently and shared personal data of children, even though it did not intend to do so. On the other hand, the DPA also considered that the controller cooperated during the procedure and eventually removed the pixels before the decision.