GENERAL
WHICH LOCAL LAW IMPLEMENTS THE EPRIVACY DIRECTIVE?
The E-Privacy Directive was implemented in Austria by amendment of the relevant provisions of the Austrian Telecommunications Act (Telekommunikationsgesetz 2003, TKG).
The changes to the TKG came into effect on 22 November 2011. The relevant section of the TKG states that a user must give informed consent for the storage of personal data.
IS THERE ANY REGULATORY GUIDANCE ISSUED TO SPECIFICALLY ADDRESS COOKIES?
No.
CONSENT
CAN A USER PROVIDE CONSENT TO COOKIES VIA WEB BROWSER SETTINGS?
Unclear, but likely no.
While it is acknowledged that browser settings may be used to pre-emptively reject cookies, there is no case law where consent via browser settings was accepted. The legal doctrine does not view consent via browser settings as sufficient.
ARE COOKIE WALLS ALLOWED?
Yes (currently).
The Austrian DPA dealt with the issue of cookie walls in connection with the website of a popular Austrian daily newspaper, which implemented a "pay or consent" solution. If cookies were not accepted, the website was only accessible with paid subscription.
The Austrian DPA argued that no material disadvantage and no considerable negative consequences were apparent from this practice, as the decision to give consent is deliberate, the data use is described in a sufficiently transparent manner, and the main consequence of not giving consent is that the user may subscribe for the service, which was considered as not disproportionately expensive. The approach was therefore deemed as acceptable. There was no appeal against this decision and no further case law on this topic.
CAN CONSENT BE IMPLICIT, (I.E. THROUGH USE OF WEBSITE)?
Unclear, but likely no.
There is no clear case law on this topic in Austria. While the website which the Austrian DPA assessed in its cookie walls decision also had implicit consent implemented, and the Austrian DPA did not deem this as unlawful, the Austrian DPA clarified later that this issue was not the subject matter of the decision and was not assessed at all. The Austrian practice otherwise follows the CJEU's approach.
TRANSPARENCY AND RETENTION
ARE THERE SPECIFIC RULES OR GUIDANCE FOR COOKIE BANNERS?
No.
IS A SEPARATE COOKIE POLICY REQUIRED IN ADDITION TO THE WEBSITE PRIVACY POLICY?
No.
ARE THERE ANY SPECIFIC RETENTION PERIODS FOR DATA HELD BY COOKIES?
No.
There has been no specific guidance on retention periods. The TKG requires that information on retention period is given when cookies are used to collect or process personal data, but does not specifically regulate exact retention periods.
DO ANY COOKIE RULES OR GUIDANCE APPLY DIFFERENTLY FOR FIRST-PARTY AND THIRDPARTY COOKIES?
No.
There is currently no such differentiation in the Austrian case law or practice.
ENFORCEMENT
IS THERE ANY REGULATORY STRATEGY ON THE ENFORCEMENT OF COOKIE RULES?
No.
HAVE THERE BEEN ANY FINES ISSUED FOR NON-COMPLIANCE OF COOKIE RULES?
No.
HAVE THERE BEEN ANY COURT CASES ADDRESSING COOKIE COMPLIANCE?
There have been no court cases on this topic.
As concerns the Austrian DPA, there is currently only one decision on cookie compliance assessing cookie walls implemented on the website of a popular Austrian daily newspaper.
Originally published 27 November 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
