Norway's DPA Called Schibsted's 39-Krone Privacy Fee 'Privacy as a Luxury'

Schibsted, Norway's largest publisher, will charge subscribers an extra 39 kroner per month from May 27, 2026 to opt out of personalized advertising across Aftenposten, VG, E24, Stavanger Aftenblad, Bergens Tidende, and three other titles. The Norwegian Data Protection Authority publicly called the model "privacy as a luxury" and asked Schibsted to wait for EU guidance before turning it on. The phrase signals enforcement appetite, not just regulator tone.

What Schibsted is actually charging for

The fee is 39 kroner a month, around $3.50 USD at current rates, roughly the price of a coffee. Pay it and the eight Schibsted consumer titles serve you non-personalized advertising. Refuse and the free tier stays funded by personalized ads against your behavior. The structure mirrors what Meta rolled out across the EU in late 2023, what Le Monde tried in 2024, and what dozens of cookie banners have been quietly testing for two years.

What makes Norway different is the regulator. Datatilsynet has historically led on adtech enforcement in Europe. It was one of the three DPAs (alongside the Dutch and Hamburg authorities) that triggered EDPB Opinion 08/2024 on consent-or-pay models with an Article 64(2) request in late 2023. The Norwegian DPA isn't reacting to a model it just heard about. It's the regulator that pushed the EDPB to write the rulebook against this kind of model in the first place.

The 'privacy as a luxury' phrase is the part that matters

Tobias Judin, head of international at Datatilsynet, told Aftenposten that this isn't good news for ordinary people's privacy. Datatilsynet's official statement is sharper. Privacy on the internet should not become the privilege of the rich.

That is the soundbite that ends up in legal filings.

When a regulator brands a business model with a specific phrase, the phrase becomes the working frame for enforcement. "Cookie walls" got effectively banned across the EU because regulators stopped describing them as a UX choice and started describing them as coerced consent. "Dark patterns" landed in the Digital Services Act for the same reason. "Privacy as a luxury" is doing the same kind of work in real time, and from what I've seen in EU enforcement timelines, this kind of framing usually shows up 18 to 24 months before binding actions actually land.

The Norwegian Consumer Council went further. Forbrukerrådet has said the changes Schibsted is making may be illegal. That is a lower bar than a DPA fine, but it lines up with the same theory of the case.

EDPB Opinion 08/2024 already moved the legal odds

The European Data Protection Board adopted Opinion 08/2024 in April 2024. The opinion was specifically about whether consent-or-pay models can produce valid GDPR consent on large online platforms. The conclusion, per the IAPP's analysis: in most cases, these models do not meet the requirements for valid consent.

The opinion didn't ban pay-or-consent outright. It did two things that quietly moved the legal odds. First, it flipped the burden of proof. The platform now has to demonstrate valid consent rather than just assume it. Second, it told platforms to "give significant consideration" to offering an additional free alternative that doesn't process behavioral data. Meta tried to challenge the opinion in the General Court of the EU, and lost in 2025.

Schibsted's defense, paraphrased from its public statement: thorough legal review, and several other major European publishers run a similar model. Both true. Both don't matter much once a DPA decides to test it. "Other people are doing it" has never really been a defense under GDPR Article 7.

Why media buyers should care before May 27

This is where the story stops being a Norwegian privacy curiosity and starts mattering for anyone running paid media in the EEA.

If the Schibsted model holds, expect a wave of large publishers with subscription revenue to add a 30-50 NOK or EUR opt-out tier within the next two quarters. The supply curve shifts in a couple of ways worth modeling. First, the share of personalized impressions on premium Nordic news inventory will likely drop a few percentage points as the vocal-but-paying minority opts out. Second, programmatic CPMs on the remaining personalized inventory tend to climb when audience density increases. Fewer "default-no" cohorts mean denser declared signal per impression, which is roughly what happened on European Meta inventory after pay-or-consent shipped there.

If the model gets struck down, which is the higher-probability outcome based on the EDPB's framing, Schibsted has to re-architect consent across eight brands at once, the Nordic supply curve for personalized inventory tightens fast, and any campaign that depends on cookie-equivalent signals on Norwegian premium news inventory needs a contingency plan ready before the redesign ships.

Either way, the media plan that assumes the status quo is the one that breaks. I'd build at least two scenarios into any Q3 2026 Nordic plan. One where Schibsted's pay-tier holds, one where it doesn't, both modeled on a CPM swing of at least 15% in either direction. Smaller advertisers in Norway should also reread their consent strings on Schibsted properties before May 27, because anything you assumed about audience opt-in rates is going to drift the moment the new flow ships. (For context on how publisher-side revenue economics keep tightening even before regulation lands, our earlier piece on small publishers losing 60% of search traffic is worth a look.)

The signals worth watching through the summer

Datatilsynet has said it will publish guidance on adjusting advertising settings on pay-or-consent platforms before Schibsted's launch date. That document, plus any movement from the EDPB on a follow-up to Opinion 08/2024, sets the enforcement clock.

Three signals that would tell me the model is dying:

• Datatilsynet opens a formal investigation within 90 days of launch.
• Forbrukerrådet files a coordinated complaint with at least one other Nordic consumer body.
• A major Norwegian advertiser publicly renegotiates an inventory deal because their legal team says the consent isn't clean enough to rely on.

If two of those land, I'd assume the May 27 model has 12 months at most. If none of them land by August, the model probably survives long enough to spread to other Schibsted-shaped publishers across the EEA.

Personally, I think the regulator just laid the brick the case will eventually be built on. "Privacy as a luxury" is too quotable to be accidental.

Notice Me Senpai Editorial