Law · Updated October 2026

Cookie banners: what Austrian law requires (as of October 2026)

Draft. This page has not been editorially reviewed yet. The legal review is still pending.

You only need consent if your website uses cookies or similar techniques that aren't strictly necessary – for statistics or advertising, for example. If you only set technically necessary cookies, you don't need a cookie banner, according to the Datenschutzbehörde (DSB, data protection authority). The legal basis is § 165 Abs 3 TKG 2021 (Telecommunications Act) together with the GDPR. If you do need a banner, rejecting must be just as easy as accepting, right on the first layer. According to media reports, since August 2026 the DSB has also been writing to website operators about this on its own initiative.

What the law requires

§ 165 Abs 3 TKG 2021
Providers of an information society service (§ 3 Z 1 ECG) may only store or read data on a user's device if the user has actively consented on the basis of clear and comprehensive information. Exempt are storage or access whose sole purpose is transmitting a message, or which is strictly necessary for a service the user has explicitly requested.
Art 6 Abs 1 lit a, Art 7 Abs 3 DSGVO iVm § 165 Abs 3 TKG 2021 (BVwG 31.07.2024, W108 2284491-1)
The BVwG (Federal Administrative Court) held that a cookie banner must offer an equivalent option to reject on the very first layer. Withdrawing or refusing consent must be as easy as giving it.
DSB-FAQ „Datenschutz & Cookies“ (Auslegung von § 165 Abs 3 TKG 2021 und DSGVO)
According to the Datenschutzbehörde (DSB, data protection authority), consent is only needed for cookies that are not technically necessary; if you don't set any, you don't need a cookie banner. Tracking, analytics and advertising cookies do not count as technically necessary, even if they fund the website. Pre-ticked boxes are not allowed, and not consenting must be as easy as consenting.
Art 57 Abs 1 lit d DSGVO (Sensibilisierungsschreiben der DSB, ab Mitte August 2026)
According to media reports, since mid-August 2026 the DSB has been sending awareness letters about cookie banners to website operators on its own initiative, without opening proceedings at first. The points named are: consent before cookies are set, a reject option on the first layer, rejecting not visually disadvantaged, and information in the privacy policy. A primary publication by the DSB on this could not be retrieved.
Art 5 Abs 3 RL 2002/58/EG (ePrivacy-RL), EDSA-Leitlinien 2/2023 zum technischen Anwendungsbereich
§ 165 Abs 3 TKG 2021 implements Art 5 Abs 3 of the ePrivacy Directive. The EDPB (EDSA) has published guidelines on the technical scope (final version after public consultation) that cover not only cookies but also other techniques such as tracking pixels and fingerprinting. This is relevant for "cookieless" analytics tools.
Vorschlag „Digital Omnibus“ (Art 88a/88b DSGVO-Entwurf)
On 19 November 2025 the European Commission proposed moving the cookie rules into the GDPR (Art 88a, 88b), including one-click rejection and binding browser signals. According to secondary sources, the procedure was still at first reading as of September 2026; the law in force remains § 165 Abs 3 TKG 2021.

Checklist

ItemLegal basis
No non-essential cookie, no localStorage entry and no tracking request before consent (Check: on the first page view, without any click in the banner, no analytics or marketing cookies and no requests to tracking services (e.g. Google Analytics, Meta Pixel) may occur.)§ 165 Abs 3 TKG 2021
Reject button on the first banner layer (Not hidden away under "Settings".)Art 7 Abs 3 DSGVO; BVwG W108 2284491-1
Reject visually equivalent to Accept (Same size, comparable contrast; no grey text link next to a big coloured button.)Art 7 DSGVO; DSB-FAQ Cookies
No pre-ticked categories (Non-essential categories off by default.)Art 25 Abs 2 DSGVO (privacy by default) laut DSB-FAQ
Website usable without consent (no cookie wall) (According to the DSB, refusing access if someone doesn't consent is generally not allowed.)DSB-FAQ Cookies
Consent can be withdrawn at any time (e.g. a "Cookie settings" link in the footer) (Withdrawing must be as easy as giving consent.)Art 7 Abs 3 DSGVO
No banner if only technically necessary cookies are set (An unnecessary banner isn't a breach of the law, but it's avoidable. You still need to inform people in the privacy policy.)§ 165 Abs 3 TKG 2021; DSB-FAQ Cookies
The privacy policy names the cookies/tools used, their purpose and legal basis (Purpose, legal basis, storage period, recipients.)§ 165 Abs 3 TKG 2021; Art 13 DSGVO

Who is exempt

  • Cookies that are strictly necessary for a service the user has explicitly requested (e.g. shopping cart, login session, multi-page forms) – allowed without consent according to the DSB FAQ
  • Storing the consent status itself (without a unique identifier) – according to the DSB FAQ
  • Storage/access with the sole purpose of transmitting a message over a communications network (§ 165 Abs 3 TKG 2021)

Common mistakes

  • You load Google Analytics or the Meta Pixel on the very first page view, before anyone has clicked in the banner.
  • Your banner only has "Accept" and "Settings" – rejecting is hidden on the second layer.
  • The "Reject" link is small and grey, "Accept all" is big and coloured.
  • In the settings dialog, statistics and marketing are already preselected.
  • There's no way to withdraw consent later because the banner never appears again after the first click.
  • You assume a tool is "cookieless" and therefore needs no consent, without checking whether it still stores or reads data in the browser (e.g. localStorage, fingerprinting).
  • Your privacy policy names tools you no longer use – or forgets the ones you do use.
  • You use a cookie banner although you only have necessary cookies, and confuse your visitors.

Frequently asked questions

Do I need a cookie banner if I only have a simple business website?

Not automatically. According to the Datenschutzbehörde (DSB, data protection authority), consent is only needed for cookies that aren't technically necessary. If your website sets no statistics, marketing or tracking cookies and doesn't load any such services, you don't need a banner. But check carefully what's embedded: analytics tools, social media pixels or some embeds often set cookies without you noticing. You still inform visitors about the data processing in your privacy policy.

Which cookies count as technically necessary?

According to the DSB FAQ, these are cookies that are strictly necessary for a service the visitor has explicitly requested. Examples: shopping cart, login status, entries in multi-page forms and storing the cookie choice itself. According to the DSB, tracking, analytics and advertising cookies are not necessary – not even if they support the website financially. For these you need prior consent under § 165 Abs 3 TKG 2021.

Does the Reject button have to look the same as Accept?

Rejecting must be as easy as accepting. In 2024 the BVwG (Federal Administrative Court) ruled that an equivalent option to reject must be available on the very first banner layer. The DSB points out that both options must be equally easy to see; differences in colour also count if they make rejecting less visible. So a big colourful "Accept" button next to a small grey link isn't enough.

Is "cookieless" analytics automatically allowed without consent?

Not automatically. § 165 Abs 3 TKG 2021 covers storing and reading information on the device – not just cookies. In its Guidelines 2/2023, the EDPB (EDSA) also deals with techniques such as tracking pixels and fingerprinting. A tool without cookies can still store data in the browser or read device information. It also often processes IP addresses, for which you need a legal basis under the GDPR. Have the specific tool checked.

Will cookie banners soon disappear because of the Digital Omnibus?

Not for now. In November 2025 the European Commission proposed moving the cookie rules into the GDPR and making browser signals binding. According to specialist reports, however, the legislative procedure had not been completed as of September 2026. Until a new rule comes into force, § 165 Abs 3 TKG 2021 continues to apply unchanged in Austria. So plan your banner according to the current law.

This page is not legal advice. What counts are the laws in force and the information from your chamber or your legal adviser.

Request a free draft for your business

No obligation, no appointment needed. Send me a few details and I'll build your first draft.

Get a free, no-obligation quote

Sources

  1. RIS – § 165 TKG 2021 (retrieved on 3 October 2026)
  2. RIS – BVwG 31.07.2024, W108 2284491-1 (Cookie-Banner) (retrieved on 3 October 2026)
  3. Datenschutzbehörde – FAQ Datenschutz & Cookies (retrieved on 3 October 2026)
  4. ITWELT – Datenschutzbehörde kündigt amtswegige Überprüfung von Cookie-Bannern an (18.08.2026) (retrieved on 3 October 2026)
  5. EDSA – Leitlinien 2/2023 zum technischen Anwendungsbereich von Art 5 Abs 3 ePrivacy-RL (retrieved on 3 October 2026)
  6. Taylor Wessing – The Digital Omnibus: cookies, consent and digital advertising (UNGEPRÜFT: Verfahrensstand nur aus Sekundärquellen) (retrieved on 3 October 2026)
  7. Web Crossing – Datenschutzbehörde prüft Cookie-Banner (retrieved on 3 October 2026)

Last checked on 3 October 2026.

Get a free, no-obligation quote