Court case Ra 2024/04/0424 – Court Ruling (Austria, 2025)

= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities didn’t fall within the scope of journalistic purposes. The court emphasised that the controller placed the cookies and processed the collected data for analytical and advertising purposes. Regarding the need for an equivalent reject option in cookie banners the court upheld the interpretation of the DPA that the first layer of the cookie banner needs to contain a visually equivalent option to reject cookies. = The controller appealed the BVwG's decision. In this appeal, the controller stated, that there is a lack of case law on the media privilege and on the design of cookie banners. The controller argued, that the Supreme Administrative Court (Verwaltungsgerichtshof - VwGH) had not yet dealt with this in substance and that thus clarification by it was required. Regarding the design of the cookie banner the court found that Article 7(3) GDPR requires an individual case-by-case examination whether refusing consent is as simple as granting it. The court held that an appeal can only be justified in cases of a blatant misassessment of the individual case-related circumstances by the first instance court. The court did not find this in the present case, stating that the reasoning of the first instance court was detailed and comprehensible. Regarding the media privilege the court held, that the appeal did not indicate which specific legal question the court would have to answer in this context.