Court case Ra 2024/04/0424 – Court Ruling (Austria, 2025)
An Austrian court ruled that a media company's cookie banner was misleading, making it hard for users to refuse cookies. This is important because it stresses the need for clear and easy consent options for users. Website operators should design cookie banners that allow users to reject cookies as easily as they can accept them.
What happened
The media company's cookie banner made it difficult for users to reject cookies.
Who was affected
Website visitors who encountered the confusing cookie banner on the media company's site.
What the authority found
The court ordered the company to redesign its cookie banner to make rejecting cookies as straightforward as accepting them.
Why this matters
This ruling sets a standard for cookie consent practices, urging companies to prioritize user-friendly options in their data collection methods.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 11 April 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (4)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Cookie consent checkboxes are pre-selected by default, violating the requirement for active, affirmative consent.
Art. 4(11) GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Related Cases (0)
No other cases found for Court case Ra 2024/04/0424 in AT
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case Ra 2024/04/0424 - Austria (2025). Retrieved from cookiefines.eu
Last updated: