Court case Ra 2024/04/0424 – Court Ruling (Austria, 2025)
A court ordered a media company to change its cookie consent banner after a visitor complained. The banner made it hard to reject cookies, which is against data protection rules. This ruling is important for ensuring that users can easily control their privacy online.
What happened
The media company's cookie banner was found to be misleading, making it difficult for users to reject cookies.
Who was affected
A website visitor who encountered the confusing cookie consent banner.
What the authority found
The court ruled that the cookie banner must be modified to allow users to reject cookies as easily as accepting them.
Why this matters
This decision reinforces the need for clear and user-friendly consent mechanisms, which is vital for all website operators to comply with data protection laws.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (4)
Cookie banner does not provide a clear reject/refuse all button at the same level as the accept button.
Art. 7 GDPR
Refusing cookies requires more clicks or steps than accepting them, or the reject option is less visually prominent.
Art. 7 GDPR
Cookie consent checkboxes are pre-selected by default, violating the requirement for active, affirmative consent.
Art. 4(11) GDPR
Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.
Art. 6(1) GDPR
Related Cases (0)
No other cases found for Court case Ra 2024/04/0424 in AT
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case Ra 2024/04/0424 - Austria (2025). Retrieved from cookiefines.eu
Last updated: