Der Standard – Court Ruling (Austria, 2025)

Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked. The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR. In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban. The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a proce