Court case W211 2281997-1/5 E – Court Ruling (Austria, 2024)
An Austrian news magazine faced a complaint for forcing users to accept tracking cookies to access its content. The data protection authority found that the consent given by users was not truly voluntary. This ruling is significant for website operators, as it emphasizes the need for clear and genuine consent mechanisms for cookies.
What happened
The website of an Austrian news magazine required users to accept tracking cookies to access its content, which led to a complaint.
Who was affected
Users of the Austrian news magazine's website were affected by the cookie consent practices.
What the authority found
The data protection authority ruled that the consent mechanism was misleading and did not allow users a real choice to refuse tracking cookies.
Why this matters
This ruling sets a precedent for how consent for cookies must be obtained. Website operators should ensure that users can easily reject non-essential cookies without hindrance.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austr
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (5)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
The cookie banner uses misleading language to trick or pressure users into accepting cookies (dark patterns).
Art. 7 GDPR
Users cannot select or deselect individual cookie categories; consent is presented as all-or-nothing.
Art. 4(11) GDPR
Related Cases (0)
No other cases found for Court case W211 2281997-1/5 E in AT
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case W211 2281997-1/5 E - Austria (2024). Retrieved from cookiefines.eu
Last updated: