Court case W211 2281997-1/5 E – Court Ruling (Austria, 2024)
An Austrian news magazine faced a ruling for forcing users to accept cookies without a real choice. The court found that the cookie consent process was misleading and did not allow visitors to refuse tracking cookies. This case underscores the need for clear and voluntary consent mechanisms.
What happened
The website required users to accept tracking cookies to access content, violating consent rules.
Who was affected
Visitors to the Austrian news magazine's website who were forced to accept tracking cookies.
What the authority found
The Austrian DPA ruled that the consent process was not voluntary, violating GDPR's requirements for user consent.
Why this matters
This decision signals that businesses must provide genuine options for users regarding cookie consent. Website operators should ensure their cookie banners are clear and allow users to reject tracking cookies.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austr
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (5)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
The cookie banner uses misleading language to trick or pressure users into accepting cookies (dark patterns).
Art. 7 GDPR
Users cannot select or deselect individual cookie categories; consent is presented as all-or-nothing.
Art. 4(11) GDPR
Related Cases (0)
No other cases found for Court case W211 2281997-1/5 E in AT
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case W211 2281997-1/5 E - Austria (2024). Retrieved from cookiefines.eu
Last updated: