Norway’s new Minister of Digitalization, Torgeir Micaelsen, announced Monday that the government is drafting a comprehensive white paper — a stortingsmelding — to overhaul how data centers enter the country’s market, following a Norwegian Board of Technology report that found foreign-owned operators control 90% of Norway’s data center electrical capacity. But the economics of displaced profits are only part of the story: data physically stored in those foreign-owned facilities remains legally accessible to the home governments of their operators — whether that is a US court order under the CLOUD Act or a Chinese national intelligence directive to ByteDance — regardless of GDPR or Norwegian law.

Norway has become one of Europe’s most sought-after data center destinations, drawing hyperscale cloud operators and AI infrastructure builders with a combination almost impossible to replicate elsewhere: electricity that is 99% hydroelectric and historically cheap, a naturally cool climate that dramatically cuts cooling costs, and European Economic Area membership that guarantees GDPR compliance for international clients. TechPolicy.Press and AlgorithmWatch documented the scale of the industry’s growth in a January 2026 investigation. What has emerged alongside that boom is a structural imbalance that Norway is now moving to correct.

Close to 90 data centers are currently operating in the country, consuming approximately 2.79 terawatt-hours (TWh) of electricity in 2025 — a 70% increase from 1.64 TWh the previous year, according to SANDS law firm citing Elhub data. An additional 53 data centers are registered with grid operator Statnett, which has reserved 3.4 gigawatts for them — representing more than 8% of Norway’s currently installed power generation capacity. Data centers now account for 40% of the capacity already reserved in the national grid. Consulting firm Thema estimates that electricity consumption from data centers could increase fivefold by 2030, reaching approximately 9 TWh — around 6% of national consumption.

Micaelsen, who took over the ministry on September 11, 2026, following a cabinet reshuffle, told the state broadcaster NRK that Norway intends to remain an attractive data center destination — but only for operators that contribute to “value creation and Norwegian interests.”

Cheap Power, Exported Profits

The Norwegian Board of Technology’s findings land with particular force because they quantify what local communities and competing industries have observed for years: data centers consume enormous quantities of power during construction and operations, create relatively few permanent jobs once built, and route their profits through foreign parent companies taxed abroad.

Sverre Gotaas, who chairs the Teknologirådet expert group on data centers and also directs Herøya Industripark — one of Norway’s flagship industrial zones for energy-intensive manufacturing — framed the problem plainly: “Once the construction period — which does create significant temporary employment — concludes, little remains for local communities. The automated nature of data center operations requires a minimal number of permanent employees while consuming enormous quantities of power, with profits largely sent directly out of the country.”

The roster of foreign operators is a register of global Big Tech. TikTok — operated by ByteDance, which is subject to China’s National Intelligence Law — hosts 50,000 servers near Oslo in a facility that began at 90 megawatts (MW) and is planned to expand to 150 MW. At 150 MW, that single facility would consume nearly one percent of Norway’s total electricity production. Google is building a campus of up to 240 MW near Skien, approximately 85 miles (137 km) southwest of Oslo, which is expected to come online before year-end. In Norway’s far north, Nscale’s Narvik campus, which Microsoft contracted for $6.2 billion in computing capacity in September 2025, is projected to scale to significant power loads when fully operational.

The data center market in Norway was valued at approximately $1.15 billion in 2025 and is projected to surpass $2 billion by 2030, with hyperscale capacity growing at over 22% annually — figures that give both proponents and critics powerful arguments for their positions.

What Happens to Your Data When the Server Is in Norway but the Owner Is in Virginia

This is where the economic debate intersects with a constitutional reality that the white paper announcement has so far underweighted. The Norwegian Board of Technology’s finding about foreign ownership is, in legal terms, also a finding about data sovereignty.

Under the US CLOUD Act of 2018, American authorities can compel US-incorporated companies — including Amazon Web Services, Google, and Microsoft — to produce data stored anywhere in the world, including on servers physically located in Norwegian data centers. The Wikipedia article on digital sovereignty outlines the CLOUD Act framework and its extraterritorial reach. Microsoft itself acknowledged in 2025 that it “cannot guarantee” European data sovereignty — confirmed under oath before the French Senate. The situation is structurally analogous for Chinese-owned operators: China’s National Intelligence Law (2017), Article 7, requires all organizations and citizens to “support, assist, and cooperate with national intelligence work,” a framework documented by digital sovereignty analysts. TikTok’s servers in Norway are operated by a company ultimately controlled by ByteDance, a Chinese-incorporated entity, and are therefore subject to this legal framework regardless of where the servers physically sit.

The Norwegian politician who has most directly named this issue is Bjørnar Moxnes of the left-wing Rødt party, who after the original Nammo incident raised the possibility — without providing evidence — that the Chinese government may have instructed TikTok to site its Norwegian data center near the country’s largest ammunition factory. The TechPolicy.Press January 2026 investigation covers Moxnes’s position and the broader political landscape. The current regulatory framework does not address this exposure because it was never designed to: under the Planning and Building Act, it is the individual municipality that decides whether a data center can be built. Schjodt law firm’s analysis of the March 2026 parliamentary resolutions noted: “There is no national coordination or control over how many data centres are to be established, where they are to be located, or whether they should be established at all.”

Can Norway Change Who Gets Power?

The most immediate policy lever is the electricity grid itself — and it was already amended before the white paper announcement.

Norway’s traditional approach to grid connection was pure first-come, first-served queuing. Starting January 2025, grid companies were required to conduct “maturity assessments” of connection requests before granting access. Then, effective July 1, 2026, a new Energy Act Section 3-8 gave the government authority to require grid companies to prioritize specific customers on national security grounds — effectively creating a security-tiering mechanism in Norway’s electricity infrastructure. The same July 2026 amendments also required data center operators to maintain updated customer registries and disclose them to Norwegian authorities, including the National Security Authority (NSM), the Police Security Service (PST), and the regular police, under specified conditions.

The conflict between data center appetite and industrial need became nationally visible in 2023, when Nammo — Norway’s largest ammunition manufacturer, co-owned by the Norwegian government and a Finnish state defense firm — revealed that TikTok’s data center had been allocated the electrical capacity that Nammo needed to expand production of artillery rounds at a time of intense demand driven by Russia’s war in Ukraine. Nammo CEO Morten Brandtzæg raised the possibility that the Chinese government directed TikTok’s facility siting near the factory; no evidence was provided. The incident became the most concrete illustration in Norway’s public debate of what it costs to allocate scarce renewable energy on a purely commercial basis with no national priority framework.

Roger Hansen, head of Herøya Arbeiderforening, a workers’ association representing employees in traditional energy-intensive industries, put the stakes bluntly in a statement reported by NRK: “We do not need an uncontrolled proliferation of data centers that require the electricity industry needs for the green transition. We fear for our jobs. If we do not get the electricity we depend on, thousands of jobs will disappear.”

Why Does Norway Have No National Veto?

Under Norway’s current legal architecture, there simply is no national authority with power to say no to a data center. The Planning and Building Act gives that authority to municipalities, whose elected representatives often welcome the construction-phase employment and tax revenue that comes with a large facility. The Norwegian Water Resources and Energy Directorate (NVE) handles infrastructure licenses. The regional and national grid companies assess capacity. None of these bodies has a mandate to evaluate whether a given facility serves Norwegian national interests.

The March 2026 parliamentary resolutions marked the beginning of a political consensus that this fragmentation is unsustainable, even if the Parliament stopped short of adopting SV’s full national licensing proposal. The two resolutions it did adopt — requiring the government to assess the societal utility of data center developments and to propose a cryptocurrency mining ban — were prerequisites for the white paper Micaelsen announced Monday.

The proposed stortingsmelding is expected to address several structural gaps. Among the measures under consideration: requirements for local value creation, potentially obligating operators or the municipalities that host them to demonstrate demonstrable economic benefit for surrounding communities. Mandatory waste heat utilization — requiring facilities to feed their thermal byproduct into local district heating networks — is also under consideration; data centers generate heat at 40–104°F (4–40°C) above ambient as an engineering byproduct of computing, and water-cooled systems can reach temperatures suitable for direct district heating injection. A differentiated licensing framework would distinguish critical data services from commercial entertainment providers, ending the current situation in which a health data warehouse and a social media video cache are treated identically in the grid connection queue.

SV’s Lars Haltbrekken, one of the most vocal critics of the current trajectory, has warned in published reporting that Norway’s total power consumption could triple or quadruple by 2030 if growth is not managed.

The Labour Party’s national executive has taken a more measured position than its left-wing coalition partners — pledging to review establishment criteria, tighten energy requirements, and strengthen oversight without halting construction outright. Minister Micaelsen has not committed to the moratorium demanded by SV and Rødt.

What Comes Next for European Cloud Infrastructure

Norway is not moving in isolation. In Sweden, a 2026 Data Centre Development Programme introduced a multi-year corporate tax incentive for large new facilities and is actively subsidizing district heating integration. Germany and France have moved in the opposite direction, with renewable energy procurement mandates that function as de facto capacity controls.

What makes Norway’s situation distinctive — and potentially a template for other resource-rich nations — is the specific intersection of cheap renewable electricity, a small domestic economy that cannot absorb the grid pressure, a geopolitically exposed neighbor (Russia), and a recent awakening to the fact that “server in Norway” does not mean “data under Norwegian law.”

The white paper is expected to be submitted to the Storting in 2027. When it arrives, it will not be a document solely about data centers — it will be a statement about who gets to use Norway’s most strategic renewable resource, and on what terms. Hyperscale operators who have already committed billions to Norwegian infrastructure have time to model what the new requirements mean for their business cases. They would be unwise to assume the answer is “nothing much.”

Where Does Norwegian Data Go When the Server Is American?

The national security dimension extends beyond TikTok and ByteDance. Under the US CLOUD Act, any American company — including Amazon Web Services, Microsoft, and Google — can be legally compelled by US authorities to produce data stored anywhere in the world, including in Norwegian data centers. Norway’s GDPR compliance provides no shield against this compulsion: GDPR governs how companies process data commercially, but it does not override a US court order issued to a US-incorporated company. A 2025 admission by Microsoft that it “cannot guarantee” European data sovereignty formalized what legal experts had long argued: physical location in Europe is necessary but insufficient for data sovereignty.

The European Union’s broader response has been the EUCS (EU Cybersecurity Certification Scheme for Cloud Services), which in early drafts required cloud providers to have EU headquarters for high-assurance public procurement contracts. France’s SecNumCloud standard takes the same approach. Norway, as an EEA member, is not an EU member and implements EU digital regulation through the EEA Agreement — a process that takes time and does not automatically include all EU-level security frameworks.

This gap matters for any Norwegian institution — a hospital, a municipality, a government agency — whose data is processed in a foreign-owned Norwegian facility. The white paper will need to address not only the economic question of who profits from Norway’s renewable electricity, but the harder question of which legal framework actually governs the data inside those buildings.

Exchange rates cited in this article are approximate as of September 30, 2026; conversions are based on an estimated USD/NOK rate of approximately 9.35.

Frequently Asked Questions

Why is Norway such a popular location for data centers?

Three advantages converge: Norway’s electricity grid runs on approximately 99% renewable energy, primarily hydropower, making it one of the few places in Europe where genuinely green computing at scale is possible. Cooling costs are dramatically lower than in continental Europe because the ambient climate does the work that air-conditioning systems do elsewhere. And EEA membership means Norwegian facilities operate under GDPR, giving international clients the same privacy compliance guarantees as EU-based facilities. The combination of low cost, low carbon, and strong data protection has made Norway one of the fastest-growing data center markets in Europe.

If my company stores data in a Norwegian data center, is that data private from foreign governments?

Not necessarily — and this is the critical gap that Norway’s proposed white paper is partly designed to address. If the data center is owned by a US company (including Amazon, Google, or Microsoft), US authorities can issue a legal order compelling the company to produce that data under the CLOUD Act of 2018, regardless of where the servers physically sit. If the facility is owned by a company subject to Chinese law — such as TikTok’s servers via ByteDance — China’s National Intelligence Law requires the company to cooperate with government intelligence requests. Norway’s GDPR compliance governs commercial data handling; it does not override foreign government compulsion directed at foreign-incorporated companies. Physical location in Norway is necessary but not sufficient for data sovereignty.

What is a stortingsmelding and why does it matter here?

A stortingsmelding (literally “Storting report” — the Storting is Norway’s parliament) is a formal white paper submitted by the government to parliament as the analytical foundation for proposed legislation. It is not a law itself, but it signals the government’s intent and typically leads to legislation. The data center white paper, expected to be submitted in 2027, is significant because it represents the first time the Norwegian government will present a unified national framework for data center regulation — replacing a system in which individual municipalities make decisions with no national coordination. Once submitted, it will go through parliamentary deliberation, industry consultation, and the usual Norwegian legislative process before any new rules take effect.

What do data centers in Norway actually do with the electricity, and why does it stress the grid so much?

Modern AI and cloud data centers run computing hardware — servers, networking equipment, and storage — continuously at high load, 24 hours a day. The computing itself generates heat, and cooling those systems requires additional energy, often adding 20-50% to the base computing power draw. A single hyperscale AI training facility can consume 200-400 MW continuously — equivalent to the electricity demand of a mid-sized city. Because Norway’s grid is built around a domestic economy of 5.5 million people, adding dozens of such facilities strains transmission infrastructure and competes directly with the energy-intensive industrial users — aluminum smelters, fertilizer plants, ammunition factories — that Norwegian industrial policy has historically been organized around.