Norway is not a member of the European Union, but as a member of the European Economic Area (EEA), it has incorporated the GDPR into its national law through the Personal Data Act (Personopplysningsloven). The national supervisory authority is Datatilsynet — the Norwegian Data Protection Authority. Norway consistently ranks among the most digitally advanced nations in the world, with high internet penetration and widespread use of platforms like Facebook, Instagram, LinkedIn, and the local marketplace Finn.no. Whether you want to verify an online date, investigate a suspicious seller on Finn.no, or protect your own photographs from impersonators, understanding Norwegian privacy law is essential before using any face search engine. For a comparison with another Nordic country, see our guide to face search in Sweden.
Face Search in Norway Overview
Face search allows you to upload a photograph to a face search engine and receive a list of public web pages where the same face appears. In Norway, this technology is used for identity verification, dating safety, marketplace fraud prevention, and personal image protection. Through the EEA agreement, Norwegian law treats facial images processed for the purpose of uniquely identifying a person as biometric data, a special category of personal data under Article 9 of the GDPR. Processing biometric data is prohibited in principle unless a narrow exception applies — most commonly the explicit consent of the data subject or processing necessary for reasons of substantial public interest. Datatilsynet has been one of the most proactive Nordic authorities on biometric issues, and its decisions have influenced regulatory approaches across the region. To understand the underlying technology, read our complete guide to facial recognition.
Datatilsynet and Norwegian Enforcement
Datatilsynet is Norway's independent data protection authority. It enforces the Personal Data Act (which implements the GDPR), investigates complaints, issues guidance, and has the power to impose administrative fines of up to 20 million euros or 4% of global annual turnover, whichever is higher. Datatilsynet has been particularly active in the biometric space. The authority made headlines when it provisionally banned Snap Inc.'s AR sunglasses from processing facial data, citing concerns about the lack of adequate privacy assessments. Datatilsynet has also scrutinized the use of facial recognition in retail stores, ruling that systems that identify customers without their explicit consent are unlawful. The authority has issued guidance on the use of CCTV with facial recognition, emphasizing that continuous biometric monitoring is almost never proportionate in commercial settings. Datatilsynet has also warned about the risks of face search tools that build permanent biometric databases.
The Personal Data Act and EEA GDPR
The GDPR applies in Norway through the EEA agreement and is implemented by the Personal Data Act (Personopplysningsloven). The core principles relevant to face search mirror those across the EU: lawfulness, fairness, and transparency; purpose limitation; data minimization; and storage limitation. Because facial data is a special category, controllers need both an Article 6 lawful basis and an Article 9 exception. For face search, this typically means explicit consent. Datatilsynet expects organizations to conduct a Data Protection Impact Assessment (DPIA) before processing biometric data at scale. The Personal Data Act also includes provisions specific to the Norwegian context, such as rules on processing personal data for journalistic and artistic purposes, and specific conditions for processing data by public authorities. Norway also has a unique tradition of open government and transparency through the Freedom of Information Act, which can create tensions with biometric data protection.
Legal Use Cases in Norway
- Online dating safety — verifying that a match on Tinder, Bumble, or a Norwegian dating platform is using authentic photos
- Marketplace fraud prevention — checking whether a seller on Finn.no or Facebook Marketplace is using stolen images
- Identity verification — confirming the identity of freelancers, contractors, or online business contacts
- Personal image protection — discovering whether your own photos are being misused by impersonators
- Journalistic and OSINT research — verifying subjects in stories of public interest
- Corporate due diligence — vetting counterparties before cross-border transactions in Norway's energy and maritime sectors
How to Use Face Search Responsibly in Norway
Using reverse face search responsibly in Norway means choosing a tool that respects both the GDPR and Datatilsynet's guidance. A compliant service deletes uploaded photos immediately after processing, does not retain facial templates, and does not build a permanent biometric database. The GDPR's household exemption may cover an individual using face search for purely personal activities — such as verifying a dating match or checking whether their own photos are being misused — but Datatilsynet and the Court of Justice of the European Union interpret this exemption narrowly. If the activity extends beyond the purely personal sphere, full GDPR compliance is required, including a lawful basis and an Article 9 exception. Norwegian users should also be mindful of the country's strong cultural norms around privacy and the right to one's own image under the Norwegian Penal Code. Always use results ethically: do not stalk, harass, or discriminate. To find someone by photo today, try facesearching by visiting the facesearching home page.
Norwegian Privacy Rights and Redress
Norwegian residents enjoy the full suite of GDPR rights: access, rectification, erasure, restriction, data portability, and objection. The Personal Data Act adds national specifics, including provisions on how public authorities handle personal data and how the right to one's own image interacts with privacy obligations. Datatilsynet operates an accessible complaints mechanism, and individuals can file complaints online without legal representation. The authority has demonstrated a strong willingness to enforce against biometric data violations, and its decisions — particularly on retail facial recognition and consumer devices — have been influential across the Nordic region. If a face search service processes your facial data in violation of the law, you have the right to seek redress through Datatilsynet and the Norwegian courts. For more on safeguarding your online presence, see our guide to protecting your digital identity.
Norway's Datatilsynet provisionally banned facial data processing in consumer AR glasses and ruled retail facial recognition unlawful — a clear signal that any face search engine serving Norwegian users must delete uploads and never retain biometric templates.