Court case W252 2282050-1/12E – Court Ruling (Austria, 2024)
An Austrian court decided that a company must improve its cookie consent banner to make rejecting cookies as easy as accepting them. This is significant because it emphasizes the importance of clear and fair consent practices for users. Companies need to ensure that users can easily manage their cookie preferences.
What happened
The court ruled that the company's cookie banner did not allow users to easily reject cookies, violating consent requirements.
Who was affected
Users of the company's website who were affected by the confusing cookie consent banner.
What the authority found
The authority found that the company violated the user's right to erasure and ordered changes to its cookie consent practices.
Why this matters
This case highlights the need for companies to create user-friendly consent mechanisms. Businesses should review their cookie banners to ensure compliance with privacy laws.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On the 09 August 2022, a data subject, represented by noyb, filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the controller unlawfully processed their personal data without the data subject's valid consent. The data subject alleged that, due to the use of dark patterns by the controller, the principle of transparency was violated and that the withdrawal of consent was not as easy as its issuance. Therefore, the data subject requested the erasure of their personal data. The option to reject cookies was a link, which was only identifiable as a link when hovering over it with the mouse. The accept button on the other hand was strongly highlighted by being placed in the middle of the banner and in a colour with strong contrast to the background. On the 22 September 2023, the DSB issued a decision on the following three points: Point 1: The data subject’s right to erasure had been violated under Article 17 GDPR. Point 2: The data subject’s right to privacy had not been violated under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=04-11-2022 §1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG). Point 3.a: The DSB ordered the controller to alter its cookie banner to make the “reject all cookies” appear in equal format to the “accept all cookies” option. Point 3.b: The controller must implement a function, which makes the revocation of consent just as simple as its declaration. The controller appealed points 1, 3a and 3b of the decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The controller posited that the GDPR does not require the “accept” and “reject” buttons to be displayed in an equal format. Further, it added that the revocation of consent was available through a footer link on the website which lead to the cookie settings. The court rejected the controller’s appeal. Point 1: The data of the data subject, at the
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (4)
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
The cookie banner uses misleading language to trick or pressure users into accepting cookies (dark patterns).
Art. 7 GDPR
No accessible mechanism exists for users to withdraw previously given cookie consent.
Art. 7(3) GDPR
Related Cases (0)
No other cases found for Court case W252 2282050-1/12E in AT
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case W252 2282050-1/12E - Austria (2024). Retrieved from cookiefines.eu
Last updated: