Norway

Summary

Norway is an EEA member but NOT an EU member state. EU regulations are not directly applicable — they require separate EEA incorporation and Norwegian parliamentary adoption. The legal position therefore lags the EU and contains important gaps. Straffeloven §204 covers unauthorised access to computer systems (requires overcoming access control or using another's credentials); public pages carry no criminal risk. The sui generis database right (EU Dir. 96/9/EC) is codified in åndsverkloven §24 — binding via EEA. GDPR applies through personopplysningsloven (2018) via EEA; Datatilsynet (Norway) co-signed the 2023 international joint statement on data scraping. The DSM Directive is EEA-relevant and a Norwegian government consultation concluded March 2024; as of the as_of_date the implementing amendments to åndsverkloven are expected but NOT yet in force — Norway does NOT yet have a statutory TDM exception with opt-out mechanism equivalent to DSM Art. 4. Until enactment, commercial TDM relies on pre-existing copyright fair-use analogues or contractual permissions only. The EU AI Act's EEA incorporation is under scrutiny by the EEA EFTA; a Norwegian implementing KI-loven (AI Act) consultation closed September 2025 with a target entry into force aligned with EU August 2026 — but formal EEA incorporation of the AI Act itself had not been confirmed as of the as_of_date, making ai_training_specific_law pending. Posture: moderate risk; conservative operators should treat Norway as pre-TDM-exception for commercial crawling purposes until the åndsverkloven amendments are enacted.