# Cookie consent in Austria: § 165 TKG 2021 and the DSB > In Austria, § 165(3) of the Telecommunications Act 2021 requires active consent based on clear and comprehensive information before cookies that are not strictly necessary are used, with the GDPR's conditions for consent. The data protection authority (DSB) says refusing must take no more clicks than accepting, so the first layer of a banner needs an option to decline that looks equivalent to Accept, and the Federal Administrative Court confirmed this in July 2024. Breaches of the information duty in § 165(3) are fined by the telecom offices up to 50,000 euros, and the DSB applies the GDPR to the tracking that follows. Source: https://cookiequiet.com/laws/austria Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Providers of public communications services and of information society services, such as websites and apps, that use cookies on users' devices in Austria - **Consent model:** Active opt-in after clear and comprehensive information; conditions of consent from Articles 4(11) and 7 GDPR - **Cookie rule:** § 165(3) Telekommunikationsgesetz 2021 (TKG 2021), transposing Article 5(3) of the ePrivacy Directive - **Authority:** Telecom offices (Fernmeldebehörden, Fernmeldebüro) for § 165(3) itself; Datenschutzbehörde (DSB) when cookies lead to processing of personal data, such as tracking cookies - **Maximum fine:** Up to 50,000 euros for failing to inform users under § 165(3) (§ 188(4) no. 24 TKG 2021); GDPR fines up to 20 million euros or 4% for unlawful processing through cookies - **Reject on first layer:** Yes, an option to decline that is visually equivalent to Accept: DSB position, confirmed by the Federal Administrative Court on 31 July 2024 (W108 2284491-1) - **Pay or okay:** Can be permissible in principle (DSB decision of 20 August 2019, DSB-D122.974/0001-DSB/2019), subject to conditions in the DSB's FAQ ## What is the Austrian cookie law? Austria transposed Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) in § 165(3) of the Telecommunications Act 2021 (TKG 2021), which replaced § 96(3) of the TKG 2003. Providers of public communications services and of information society services within the meaning of the E-Commerce Act must tell users which personal data they will process, on which legal basis, for which purposes and for how long. Collecting the data is only allowed if the user has actively given consent on the basis of clear and comprehensive information. Two cases do not need consent: technical storage or access whose sole purpose is to transmit a message over a communications network, and what is strictly necessary for the provider of an information society service the user expressly requested to provide that service. The DSB calls these "technically necessary cookies"; all other cookies need consent, and the conditions for that consent come from Articles 4(11) and 7 of the [GDPR](/laws/gdpr). ## Who enforces cookie rules in Austria? Enforcement is split. Breaches of § 165(3) itself are a matter for the telecom offices (Fernmeldebehörden, in practice the Fernmeldebüro), which run administrative penalty proceedings under the TKG. The data protection authority, the Datenschutzbehörde (DSB), is competent when cookies lead to processing of personal data, which it says is the case in particular for tracking cookies that record browsing behavior to show personalized advertising. Most cookie banner cases, including those brought by noyb, have gone through the DSB under the GDPR. ## What must a cookie banner do in Austria? The DSB set out its position in its FAQ on cookies and data protection and in its newsletter 3/2022: - **Declining is as easy as accepting.** Not giving consent, or continuing to browse without consent, must be as easy as giving it. Refusing must not require more interactions with the banner than accepting. - **No refusal hidden on a second layer.** Visitors cannot be required to go to a second or third layer to decline. - **No nudging.** Visitors must not be pushed toward consent, directly or subtly. Making the button that declines less prominent than the button that accepts, by its design or position, is not a fair practice. - **Easy withdrawal.** Under Article 7(3) GDPR, withdrawing consent must be as easy as giving it. The Federal Administrative Court (Bundesverwaltungsgericht) confirmed this on 31 July 2024 (W108 2284491-1). The DSB had ordered an online newspaper, on a complaint represented by noyb, to add to the first layer an option to close the banner without consent that is visually equivalent to "Accept". The court upheld the order: declining must not cost more clicks than accepting, and a refusal reachable only on a second layer does not give unambiguous consent. The option does not have to be called "Reject"; it has to be equivalent. Our [Reject all guide](/guides/reject-all-button) covers the design side. ## Are pay or okay walls allowed in Austria? In principle, yes. In a decision of 20 August 2019 (DSB-D122.974/0001-DSB/2019) the DSB held that a model where visitors either pay for access or consent to cookies for personalized advertising can be permissible. Its FAQ lists requirements such a model must meet in any case. The EDPB's later Opinion 8/2024 on large online platforms is stricter for those platforms, so a pay or okay wall is a decision to take with legal advice. ## Do analytics cookies need consent in Austria? Generally yes. Austria has no authority-backed analytics exemption like the French one: only technically necessary cookies are exempt, and analytics that sets identifiers is not needed to deliver the page the visitor asked for. Analytics also raised transfer questions. In a partial decision of 22 December 2021 (D155.027), the first decision on noyb's 101 complaints after the Schrems II judgment, the DSB found that a health website's use of Google Analytics transferred personal data to the United States in breach of the GDPR, and it confirmed that view in a second decision of 22 April 2022. The EU-US Data Privacy Framework, adopted on 10 July 2023, changed the transfer analysis for certified US companies, but not the consent requirement for the cookie. See [analytics without consent](/blog/analytics-without-consent). ## How much are the fines in Austria? Under § 188(4) no. 24 TKG 2021, a provider that fails to inform users as § 165(3) requires commits an administrative offense punishable by a fine of up to 50,000 euros, imposed by the telecom offices. Where cookies lead to unlawful processing of personal data, the DSB can use all its GDPR powers: orders to change the banner within a deadline, as in the 2024 case above, and fines up to 20 million euros or 4% of worldwide annual turnover. ## Does the banner need to be in German? The law asks for clear and comprehensive information, and the GDPR asks for clear and plain language. For a site aimed at Austrian visitors, that means a banner and a cookie policy in German, with other languages for other audiences. ## How does Cookiequiet fit Austrian rules? Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all and Accept all sit on the first layer with the same size and weight by default, and visitors whose browser asks for German get the banner in German. Every choice goes into a consent log with its date and banner version. Geo-targeting is free on every plan; see [pricing](/pricing). ## Questions ### Which law regulates cookies in Austria? Section 165(3) of the Telecommunications Act 2021 (TKG 2021), which transposes Article 5(3) of the ePrivacy Directive and replaced § 96(3) of the TKG 2003. The conditions for valid consent come from the GDPR. ### Does an Austrian cookie banner need a Reject button on the first layer? It needs an option on the first layer to decline that is visually equivalent to Accept. The DSB says refusing must not take more clicks than accepting, and the Federal Administrative Court confirmed this on 31 July 2024. A Reject all button next to Accept all is the simplest way to meet it. ### Who fines cookie breaches in Austria? The telecom offices fine breaches of § 165(3) TKG 2021 itself, up to 50,000 euros for failing to inform users. The DSB acts when cookies lead to processing of personal data, such as tracking, and can order changes or impose GDPR fines. ### Is pay or okay allowed in Austria? The DSB held in a decision of 20 August 2019 that a choice between paying and consenting to advertising cookies can be permissible in principle, under conditions set out in its FAQ. Large online platforms face the stricter EDPB Opinion 8/2024. ## Sources - [Telekommunikationsgesetz 2021 (TKG 2021), consolidated text with § 165 and § 188, RIS](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011678) - [DSB, FAQ zum Thema Cookies und Datenschutz](https://dsb.gv.at/dam/jcr:a6ebcf0b-0874-4aa5-b88d-f79bcce5330c/DSB%20FAQ%20zum%20Thema%20Cookies%20und%20Datenschutz.pdf) - [DSB, Newsletter 3/2022 (FAQ on cookies, competence of the telecom offices and the DSB, pay or okay decision of 20 August 2019, Google Analytics II)](https://dsb.gv.at/sites/site0344/media/downloads/newsletter_dsb_3_2022.pdf) - [Bundesverwaltungsgericht, decision of 31 July 2024, W108 2284491-1 (cookie banner of an online newspaper), RIS](https://ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20240731_W108_2284491_1_00/BVWGT_20240731_W108_2284491_1_00.html) - [DSB, partial decision of 22 December 2021, D155.027 (Google Analytics), copy published by WKO](https://news.wko.at/sbg/news/dsb-d155.027-google-analytics.pdf)