VPNs with servers in Norway

Traffic and location data must otherwise be deleted or anonymised once communication, invoicing or section 3-13 no longer needs them (section 3-11). Police may obtain the IP data only for an offence carrying three years or more, or one on the list in section 3-14, on a written request. Under section 3-12, providers must run networks so that statutory access to end-user information is secured.

Data centre operators must register and keep appropriate security and preparedness (section 3-7). Whether a VPN operator is a provider of a public service within sections 3-12 and 3-13 is not established by the text.

Under section 32 a of the Gambling Act, the Norwegian Gambling Authority (Lotteritilsynet) may order internet providers to DNS-block a site offering gambling aimed at the Norwegian market without a permit, if the reasons for the order outweigh its drawbacks, weighing freedom of expression and information. The order may fix the landing page, and must be lifted if its basis lapses and the site’s holder asks.

A joint decision of 19 February 2026 was addressed to the national internet access providers, with blocking due by 26 February 2026.

The Penal Code of 2005 punishes a public discriminatory or hateful statement, made intentionally or with gross negligence, with up to three years (section 185); the same statement made in the presence of others to the person affected carries up to one year.

The grounds include skin colour, ethnic origin, religion, homosexual orientation and reduced functional capacity. Harassing conduct, including stalking, carries up to two years (section 266), serious stalking up to four.

Section 266 is among the offences named in section 3-14 of the Electronic Communications Act for which the police may obtain the IP-address data.

The Intelligence Service Act’s chapters 7 and 8 (“digital border defence”) let the service collect communication crossing the border. They have been in force since 1 January 2022, except section 7-3.

Since 1 October 2023 Oslo District Court decides on mirroring in advance, for at most two years; searches need fresh court approval, including of the search terms. The EOS Committee oversees the services for the Storting and checks that searches follow the court’s rulings.

On 26 March 2025 Oslo District Court dismissed one claim and acquitted the State on the rest, in a case on the Constitution, the ECHR and EEA law. On 23 March 2026 the Borgarting Court of Appeal referred it to the EFTA Court (E-5/26). The order of the rows is the security score, and a server’s location is not a recommendation.