The framework
Norway regulates personal data through the GDPR (via EEA) + Personal Data Act 2018, supervised by Datatilsynet.
For advertisers the consent posture matters most, and Norway sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
GDPR (via EEA) + Personal Data Act 2018
Norway applies the GDPR in full through the EEA and enforces hard: Datatilsynet's Grindr fine (NOK 65M) over sharing user data with adtech partners is a landmark for app monetization, and its 2023 order against Meta's behavioral advertising pushed the EU-wide consent requirement.
Marketing and advertising
GDPR applies through the EEA Agreement; ePrivacy consent for cookies. Most channel decisions here follow from that consent rule.
Cross-border transfers
GDPR Chapter V applies in full, so personal data leaves the EEA only under an adequacy decision, standard contractual clauses, binding corporate rules or a narrow derogation, with a transfer impact assessment expected where the destination has surveillance-law exposure. The mechanics are identical across the bloc, so a transfer stack built for one member state travels to all of them.
Enforcement and penalties
The GDPR's ceiling applies, with fines up to EUR 20M or 4% of global annual turnover, whichever is higher, levied by the national supervisory authority, and the EDPB can force a harder line through the dispute mechanism. Member states share the ceiling and differ in enforcement appetite.