Austria requires opt-in consent before any cookie that is not strictly necessary, under Section 165(3) of the Telecommunications Act 2021 (TKG 2021). Two authorities share the job: the telecom authorities (Fernmeldebehörden) can fine breaches of Section 165(3) up to EUR 50,000, and the Data Protection Authority (Datenschutzbehörde, DSB) enforces the GDPR for the personal data cookies collect. Since a Federal Administrative Court ruling of July 2024, an equally prominent reject option on the first layer of the banner is the standard.
The legal framework: TKG 2021 and the GDPR
Austria regulates cookies and tracking technologies through two overlapping instruments. Section 165(3) of the Telekommunikationsgesetz 2021 (TKG 2021) transposes the EU ePrivacy Directive into Austrian law and governs when cookies may be placed on a device. The GDPR (applied domestically through the Datenschutzgesetz, or DSG) covers the processing of personal data collected via those cookies.
The TKG 2021 replaced the earlier TKG 2003 in November 2021, aligning Austrian telecommunications law with the European Electronic Communications Code. For cookie compliance, the core rule remains the same: storing or accessing information on a user's device requires prior, informed consent unless a narrow exemption applies.
Enforcement is split. Under Section 188(4) of the TKG 2021, breaches of Section 165(3) are administrative offences punished with fines of up to EUR 50,000, imposed by the telecom authorities (Fernmeldebehörden). The Austrian Data Protection Authority, the Datenschutzbehörde (DSB), enforces the GDPR for personal data collected through cookies. A single cookie problem can therefore lead to proceedings under either regime, or both.
Which cookies need consent under Austrian law
The TKG 2021 draws a clear line between cookies that require consent and those that do not.
Cookies that serve the sole purpose of carrying out a communication over an electronic communications network, or that are strictly necessary to provide a service explicitly requested by the user, are exempt from the consent requirement. Session cookies like PHPSESSID, load-balancer cookies, and shopping cart cookies typically fall into this category.
Every other cookie, including analytics cookies such as _ga, marketing cookies like _fbp and _gcl_au, and social media embeds, requires opt-in consent before being set. The DSB has been explicit that "economic necessity" does not make a cookie technically necessary. Advertising cookies used to finance a website are not exempt just because the business depends on ad revenue.
| Cookie type | Examples | Consent required | Legal basis |
|---|---|---|---|
| Strictly necessary | PHPSESSID, cart tokens | No | TKG 2021 Section 165(3) exemption |
| Functional or preferences | Language and theme settings | Yes | GDPR Article 6(1)(a) consent |
| Analytics | _ga, _ga_* | Yes | GDPR Article 6(1)(a) consent |
| Marketing or advertising | _fbp, _gcl_au | Yes | GDPR Article 6(1)(a) consent |
The 2021 Google Analytics ruling and what changed since
Austria became the first EU member state to rule that the use of Google Analytics violated the GDPR following the Schrems II decision. In its December 2021 ruling (case reference 2021-0.586.257), the DSB found that a medical news website, NetDoktor, had unlawfully transferred personal data to Google LLC servers in the United States by using Google Analytics.
The DSB concluded that Google's IP anonymisation feature was not properly implemented, and that unique identification numbers generated by Google Analytics could be used to single out individual users. Because Google is subject to US surveillance laws, the authority held that contractual safeguards alone were insufficient. The website had failed to implement adequate "supplementary measures" as required by GDPR Chapter V.
This decision triggered a domino effect across Europe. The French CNIL, the Italian Garante, and the Danish Datatilsynet each issued similar findings in the months that followed.
The transfer question has moved on since. On 10 July 2023, the EU adopted an adequacy decision for the EU-US Data Privacy Framework, which covers certified US companies such as Google LLC, and on 3 September 2025 the EU General Court dismissed the challenge to it (Latombe, T-553/23). The 2021 finding therefore no longer blocks Google Analytics on its own, but consent before the cookies load is still required.
Cookie banner rules: equal Accept and Reject
The DSB's FAQs on cookies and data protection set out how cookie banners must be designed.
The reject option cannot be made less prominent than the accept option. Both buttons must appear on the first layer of the banner. The DSB requires equal design in colour, size, contrast, placement, and prominence. A coloured "Accept all" button paired with a grey "Reject" text link does not meet this standard. In a judgment of 31 July 2024 (W108 2284491-1/15E), the Federal Administrative Court required an equally prominent reject option on the first layer, and on 16 January 2025 the Supreme Administrative Court rejected the appeal against it (Ra 2024/04/0424).
For legibility, the WCAG 2.2 non-text contrast criterion (1.4.11) asks for a contrast ratio of at least 3:1 for interactive elements, a sensible floor for both buttons.
Pre-ticked checkboxes do not constitute valid consent, consistent with the CJEU's Planet49 ruling (Case C-673/17). Consent must be freely given, specific, informed and unambiguous: an affirmative opt-in action from the user. Scrolling, continued browsing, or closing the banner without making a choice does not qualify.
These rules align closely with the positions taken by the CNIL in France and the German authorities under the TDDDG, though Austria's explicit stance on button parity is particularly detailed.
Enforcement and fines
Cookie-specific violations under the TKG 2021 carry administrative fines of up to EUR 50,000, imposed by the telecom authorities. GDPR violations handled by the DSB can attract the standard GDPR penalty regime: up to EUR 20 million or 4% of global annual turnover, whichever is higher.
While no publicly reported fines have targeted cookie violations specifically under the TKG 2021, enforcement pressure is growing. Activist organisations such as noyb (based in Vienna) have filed hundreds of complaints about dark patterns in cookie banners across the EU, and many of those complaints are directed at the DSB.
How Austrian rules compare to neighbouring countries
Austria's framework sits within the broader EU cookie consent regime but has distinct characteristics worth noting if your website targets the DACH region and Central Europe.
Germany's TDDDG follows a similar structure, requiring opt-in consent for non-essential cookies under its own ePrivacy transposition. The Czech Republic's UOOU and Hungary's NAIH also require prior consent, though enforcement intensity varies. Austria's DSB has been comparatively influential through its early Google Analytics decision and detailed banner design guidance.
One practical difference is the TKG 2021's EUR 50,000 cap on cookie-specific fines, which is lower than the GDPR maximum. German cookie fines under the TDDDG can reach EUR 300,000. Both countries supplement these with GDPR penalties for the underlying data processing.
Checklist for Austrian websites
If your website is accessible to Austrian visitors or your organisation is established in Austria, these steps form the baseline.
Run a cookie scan to identify every cookie and tracker on your site, including those set by third-party scripts
Classify each cookie as strictly necessary, functional, analytics, or marketing
Block all non-essential cookies until the user gives explicit opt-in consent
Present a cookie banner with equally prominent accept and reject buttons on the first layer
Keep both buttons legible, with at least 3:1 contrast (WCAG 2.2)
Provide granular category-level choices so users can consent to specific cookie types
Record and store consent receipts with timestamps
Review third-country data transfers: for US providers, check Data Privacy Framework certification, otherwise use other GDPR Chapter V safeguards
Set up Google Consent Mode v2 if you use Google services
Publish a clear cookie policy listing each cookie, its purpose, duration, and provider
Short answers on Austrian cookie rules
Does Austria require cookie consent for analytics cookies?
Yes. Under Section 165(3) of the TKG 2021, analytics cookies such as _ga are not considered strictly necessary and require prior opt-in consent from the user before being placed on their device.
What is the maximum fine for cookie violations in Austria?
Cookie-specific violations under the TKG 2021 carry fines of up to EUR 50,000, imposed by the telecom authorities. If the cookie use also involves unlawful personal data processing, GDPR fines of up to EUR 20 million or 4% of global turnover may apply on top.
Can I use Google Analytics on an Austrian website?
You can, with prior consent. The DSB ruled in 2021 that a site's use of Google Analytics broke the GDPR's transfer rules, but since July 2023 transfers to Google LLC rely on the EU-US Data Privacy Framework, which the EU General Court upheld in September 2025.
Does the reject button need to be the same size as the accept button in Austria?
Yes. The DSB requires that the reject option must match the accept option in colour, size, contrast, and placement. Making the reject option less prominent, for example a grey text link next to a coloured button, is treated as a dark pattern. The Federal Administrative Court took the same line in July 2024.
Which authority enforces cookie rules in Austria?
Two do. The telecom authorities (Fernmeldebehörden) enforce Section 165(3) of the TKG 2021, the rule on placing cookies, with fines of up to EUR 50,000. The Data Protection Authority (DSB) enforces the GDPR for the personal data those cookies collect.
Is a cookie wall allowed under Austrian law?
The DSB has indicated that consent must be freely given. Blocking access to a website entirely unless a user accepts all cookies is unlikely to meet this standard, as it effectively forces consent rather than offering a genuine choice.
Give Austrian visitors two equal buttons
Detection, categorisation, blocking and consent records are the parts of cookie work that go stale when done by hand. Kukie.io handles them, with Reject all beside Accept all on the first layer, and the global compliance hub covers the other countries your visitors come from.
