According to reports, several website operators have received a letter from the Austrian Data Protection Authority stating that their implementation of cookies may be problematic. For small and medium-sized enterprises with their own website, this is a clear reason to review their cookie banner and the associated privacy policy.
What the authority has announced
According to information from DSGVO-zt GmbH, organisations have received a letter from the data protection authority based on Article 57(1)(d) of the GDPR. In the letter, the authority refers to its powers under Section 18 of the Data Protection Act (DSG) to monitor compliance with data protection regulations, as well as to its duty to raise awareness amongst data controllers in accordance with Article 57(1)(d) of the GDPR and to draw their attention to alleged infringements in accordance with Article 58(1)(d) of the GDPR.
According to this source, the letter states that the authority had been made aware that the website in question was using cookies and similar technologies without a valid legal basis for doing so. Following a preliminary review, the data protection authority considered the allegations to be plausible but has decided, for the time being, not to initiate a formal investigation. Instead, according to the letter, the operators are being given the opportunity to review their website, and in particular the cookie banner, once again.
According to the source, the letter sets out the following points: For cookies that are not technically necessary – such as advertising or tracking cookies – valid consent from users is required. This consent must be obtained before the cookies are set or read. According to the letter, the authority refers to its own case law, which states that the first level of the cookie banner must include an option to close it, for example via „Reject cookies“. Furthermore, the „Reject“ option must not be designed in such a way that users might overlook it — for example, if „Accept cookies“ appears large and clearly visible, whilst ‘Reject cookies’ is barely noticeable. Finally, users must be informed about the setting and reading of cookies that are not technically necessary, for example in a privacy policy.
Why this is relevant for Austrian SMEs
Applied to an SME with its own website, this means that a cookie banner which sets advertising or analytics cookies as soon as the page loads – before the user has made a decision – does not comply with the standard set out in the letter described. The same applies to banners where the option to opt out is visually concealed or can only be accessed after several clicks.
In practice, this typically concerns integrated third-party tools — such as those for web analytics, retargeting or social media plugins — which automatically load scripts when a page is accessed. If no technical distinction is made between necessary and non-necessary cookies, this creates precisely the situation described in the letter. For an SME, this does not automatically mean an imminent investigation by the authority, but it does illustrate the criteria the authority applies when carrying out an assessment.
What you should check now
- Open your own website in incognito mode and use the browser’s developer tools to check which cookies are set before the user makes a decision.
- Please check that your cookie banner on the first level offers an equally prominent option to opt out alongside the option to consent.
- Compare the categories listed in the banner with the services actually integrated, particularly in the case of third-party analytics and marketing tools.
- Please check whether your privacy policy specifically describes the setting and reading of cookies that are not technically necessary, and whether it is up to date.
- Please document the outcome of this review so that you can provide a clear response should the data protection authority make an enquiry.