How does Datatilsynet + Norwegian GDPR + cookie banner work in Magento?

Norway adopted GDPR via the EEA agreement, the regulation is the same as EU GDPR, transposed nationally as Personopplysningsloven (the Personal Data Act, 2018) and enforced by Datatilsynet (the Norwegian DPA).

What that means for Magento:

• Cookie consent, granular, per-purpose opt-in. No pre-ticked checkboxes. “Reject all” must be as easy as “Accept all”. Same standard as the rest of EEA, enforcement is solid but slightly less aggressive than CNIL (FR).
• Lovlig grunnlag (legal basis), for every data process you need a documented legal basis: consent, contract, legitimate interest, etc. Magento’s customer_log, quote, sales_order retentions need explicit retention periods.
• DSAR support, Norwegian customers can request access, deletion, portability. We wire Magento customer export + anonymisation workflows.
• Hosting / data residency, Datatilsynet accepts EEA-region hosting (including AWS Stockholm, GreenMountain NO, Hetzner DE). Cross-border to non-EEA (e.g. US-region AWS) needs Standard Contractual Clauses + Transfer Impact Assessment post-Schrems II.

We ship Cookiebot / OneTrust / Coi (a Norwegian-native option) banner wired into Magento’s cookie API, banner copy reviewed against Datatilsynet guidance.