According to reports, several website operators have received a letter from the Austrian Data Protection Authority stating that their implementation of cookies may be problematic. For small and medium-sized businesses with their own websites, this is a clear reason to review their cookie banners and the accompanying privacy policies.
What the agency announced
According to information from DSGVO-zt GmbH, companies have received a letter from the data protection authority based on Article 57(1)(d) of the GDPR. In the letter, the authority refers to its authority under Section 18 of the DSG to to monitor compliance with data protection regulations, as well as to its duty to raise awareness among data controllers pursuant to Article 57(1)(d) of the GDPR and to notify them of alleged violations pursuant to Article 58(1)(d) of the GDPR.
According to this source, the letter states that the authority was made aware that the website in question uses cookies and similar technologies without a valid legal basis for doing so. After a preliminary review, the data protection authority deemed the allegations plausible but has decided, for the time being, not to initiate a formal investigation. Instead, according to the letter, the operators are being given the opportunity to review their website—and in particular the cookie banner—once again.
According to the source, the letter cites the following points: For cookies that are not technically necessary—such as advertising or tracking cookies—valid user consent is required. This consent must be obtained before the cookies are set or read. According to the letter, the authority cites its own case law, which states that the first level of the cookie banner must include an option to close it, such as „Reject Cookies.“ Furthermore, the opt-out option must not be designed in such a way that users could overlook it—for example, if „Accept Cookies“ appears large and clearly visible, while „Reject Cookies“ is barely noticeable. Finally, users must be informed about the setting and reading of cookies that are not technically necessary, for example in a privacy policy.
Why This Is Relevant for Austrian SMEs
Applied to an SME with its own website, this means: A cookie banner that sets advertising or analytics cookies as soon as the page loads—before the user has made a decision—does not meet the standard outlined in the letter described above. The same applies to banners where the opt-out option is visually hidden or can only be accessed after several clicks.
In practice, this typically involves integrated third-party tools—such as those for web analytics, retargeting, or social media plugins—that automatically load scripts when a page is viewed. If no technical distinction is made between necessary and non-necessary cookies, this creates precisely the situation addressed in the letter. For an SME, this does not automatically mean an impending audit by the authority, but it does illustrate the criteria the authority applies during an assessment.
What You Should Check Now
- Open your own website in incognito mode and use the browser's developer tools to check which cookies are set before the user makes a decision.
- Check to see if your cookie banner on the first level offers an equally visible option to opt out next to the consent option.
- Compare the categories listed in the banner with the services that are actually integrated, particularly when it comes to third-party analytics and marketing tools.
- Check to see if your privacy policy specifically describes the setting and reading of cookies that are not technically necessary and whether it is up to date.
- Document the results of this review so that you can respond in a transparent manner should the data protection authority make an inquiry.