Cookie banners: what Austrian law really requires
Reject must be as easy as accept, and analytics needs consent. What § 165 TKG 2021 and the GDPR require, and a checklist for your website.
2 min read
Anything on your website that is not strictly necessary may only be stored or read on a visitor’s device after consent. Rejecting must be as easy as accepting, and nothing may load before the visitor has decided.
Almost every business website has a cookie banner, and many of them do not meet the rules. Not out of bad intent, but because website builders and plug-ins load more than their owners know. This post explains what applies in Austria and how to check your own site.
Two sets of rules
In Austria, § 165 (3) of the Telecommunications Act 2021 (TKG 2021) governs whether information may be stored on or read from a device at all. That covers cookies, but also local storage and similar techniques. It is allowed without consent only if it is strictly necessary to provide a service the visitor explicitly asked for, or to transmit a communication.
What the consent must look like comes from the GDPR: freely given, specific, informed and unambiguous, and it must be as easy to withdraw as to give (Art. 4(11) and Art. 7 GDPR). As soon as personal data is processed, for example IP addresses sent to a third party, the GDPR applies as well.
What needs consent
- analytics and statistics tools, as a rule
- advertising and retargeting pixels, social media plug-ins
- embedded videos and maps from third parties, such as YouTube or Google Maps
- chat widgets and similar tools that load from external servers
No consent is needed for what the site cannot work without: a session cookie for the shopping cart or login, a cookie that stores the consent decision itself, or load balancing.
What a correct banner looks like
The European data protection authorities agreed on common positions in a task force on cookie banners in 2023. The key points:
- a “Reject” button on the first layer, just as visible as “Accept”
- no pre-ticked boxes
- no design tricks, such as a pale reject link next to a bright accept button
- “legitimate interest” is no substitute for consent here
- a way to change or withdraw the decision later, for example a link in the footer
Check your own site
- Open your website in a private browser window and do not click the banner.
- Open the developer tools (F12), tab “Network”, and reload. Every request to another domain before your decision is a candidate for a problem.
- Under “Application” → “Cookies” you see what was already stored.
- Click “Reject” and repeat: after rejecting, only necessary requests should remain.
- Compare the result with your privacy notice: everything that loads must be described there.
Frequent pitfalls
- Fonts loaded from Google’s servers transmit the visitor’s IP address. Host them on your own server instead.
- Videos and maps load as soon as the page opens. A placeholder that only loads the content after a click solves this.
- The banner says “necessary only”, but the statistics script starts anyway.
Want a second pair of eyes? Our GDPR quick check covers website, forms and cookies. See our services.
Right of access: find out what a company knows about you
Art. 15 GDPR lets you ask any company which data it holds about you, free of charge and without giving reasons. How it works, with a template.
3 min read
Data breach: what to do in the first 72 hours
An email to the wrong recipient, a lost laptop, a hacked account: when a data breach must be reported, to whom, and how to stay calm. With a checklist.
2 min read
AI literacy: what Article 4 of the AI Act asks of businesses
Since February 2025, every business that uses AI tools at work has to make sure its people know how to use them. What that means for small businesses, in five steps.
2 min read
Data protection updates
New rules, practical tips and templates for your business, at most once a month.