Elkjøp Nordic AS – €17,400,000 Fine (Norway, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Elkjøp Nordic was fined €17.4 million for not giving customers enough choices about how their data could be used. This is important because it shows that companies must provide clear options for users regarding their personal information, especially for marketing and profiling.
What happened
Elkjøp Nordic's customer club required users to give all their consent at once, without options for specific choices.
Who was affected
Customers of Elkjøp Nordic who were part of the customer club and had their data used for marketing without proper consent.
What the authority found
The authority ruled that Elkjøp Nordic violated GDPR by not allowing users to make granular choices about their data consent.
Why this matters
This case sets a strong precedent that companies must allow users to control how their data is used. Small businesses should ensure they provide clear and separate consent options to avoid hefty fines.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
Entities Involved
The DPA carried out an on-site inspection at Elkjøp Nordic AS, the controller, and Elkjøp Norge AS on June 2022. The inspection concerned the controller’s processing of customer information. It followed several personal data breach notifications, complaints and tips concerning the controller’s customer club. The controller operated a customer club for marketing purposes. Membership was presented to customers mainly as a way to receive discounts, exclusive offers and other benefits. However, membership also involved several processing activities, including newsletters, SMS marketing, profiling, personalisation and analysis. The controller relied on consent under Article 6(1)(a) GDPR for this processing. The controller described the customer club consent as an “all or nothing” solution and as a “package”. A customer could not join the customer club without also accepting profiling, personalisation, analysis and marketing communications. The controller considered these activities to form one commercial value proposition. After joining, customers could opt out of certain marketing channels, but they were not given a granular choice before giving consent. The controller also tested the use of customer match tools. This involved matching customer email addresses and/or telephone numbers with identifiers held by advertising platforms. The personal data used for this tool had originally been collected in connection with the customer club. The controller relied on Article 6(1)(f) GDPR for this processing and did not carry out a compatibility assessment under Article 6(4) GDPR, as it considered the purpose to be the same as the customer club purpose. In addition, the controller used offline conversion tools to measure and estimate the effect of digital marketing on purchases made in physical stores. After an in-store purchase, the controller sent information to Google and Facebook to compare purchases with clicks on digital advertisements. The controller relied on Article 6(1
Violations (1)
Users cannot select or deselect individual cookie categories; consent is presented as all-or-nothing.
Art. 4(11) GDPR
Related Enforcement Actions (0)
No other enforcement actions found for Elkjøp Nordic AS in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
1 June 2026
Authority
Datatilsynet (Norway)
Fine Amount
€17,400,000
200,000,000 NOK
GDPRhub ID
gdprhub-10052About this data
Cite as: Cookie Fines. Elkjøp Nordic AS - Norway (2026). Retrieved from cookiefines.eu
Last updated: