A ruling by the Austrian Federal Administrative Court (BVwG) on 13 August 2025 heralds a new round in the long dispute over the admissibility of so-called ‘Pay or Okay’ or ‘Cookie Wall’ practices in consent management on websites and in apps.
The court declared the specific implementation of the cookie banner (CMP) used by the newspaper Der Standard to be unlawful, as the blanket consent option did not allow website visitors to consent or refuse consent in a granular manner to different processing purposes (advertising, profiling, analysis), contrary to the GDPR’s requirements for voluntary consent.
It is important to emphasise that the BVwG only criticised the lack of granularity with regard to consent, but did not declare the widespread practice itself to be incompatible with the requirement of voluntary consent, whereby free access to the website is made dependent on consent to the setting of advertising cookies in any case. These solutions, also known as ‘Cookie Walls’, can be found across Europe, for example, on the German news website spiegel.de.
About the granular consent requirement
Visitors to the website of Der Standard were given the choice of either taking out a paid subscription (‘pay’) or agreeing to data processing for advertising, profiling, and analytics purposes by clicking on an “agree” button (‘okay’). There was no differentiated selection of which of the various processing purposes – for web analysis, personalised advertising or social media plug-ins – one wished to consent to.
The data protection organisation NOYB, co-founded by data protection activist Max Schrems, had taken action against this design of the cookie banner.
According to the BVwG’s decision, the necessary granularity for effective consent was lacking. This requirement arises directly from the wording of the GDPR, according to which consent must be given ‘for one or more specific purposes’. In addition, recital 32 of the GDPR stipulates that, in principle, individual consents are required for multiple processing purposes. According to recital 43, consent is not freely given if it is only requested in a ‘bundle’, even though a separate request would be ‘appropriate’.
In the opinion of the BVwG, separate consent promts would have been ‘appropriate’ in this case, as according to the privacy policy, different purposes (functional, analytics, and advertising) were pursued. This assessment is also in line with the EDSA guidelines on consent and the EDSA opinion 08/2024 on ‘consent or pay’ models, which reject voluntary consent in the case of a bundle of different purposes without a separate selection option. The German Data Protection Conference also requires a ‘very close connection’ between the purposes for pure subscription models with bundled purposes. In the present case, this connection did not exist to a sufficient degree.
According to the court, blanket consent as an alternative to a paid subscription does not constitute an appropriate balance between the fundamental rights concerned (data protection and entrepreneurial freedom); in particular, a purely economic interest cannot justify waiving the requirement for separate consent prompts.
The GDPR media exception does not apply
During the court proceeding, Der Standard also argued on the basis of the GDPR media exception, according to which journalistic work protected by fundamental rights may deviate from GDPR rules, for example with regard to consent requirements.
However, the court denied the applicability of media privilege, as the placing of advertising cookies or cookies for the integration of social media plugins, for example, do not serve journalistic purposes, but are rather intended to generate advertising revenue or transfer personal data to Google or Facebook.
Outlook and practical implications
The decision is not yet final; the right to an appeal has been granted. NOYB considers it likely that the next instance would refer certain questions regarding the effectiveness of the users’ consent options in Cookie Walls to the ECJ.
Der Standard has since announced that it will implement the requirements set by the court regarding the granularity of consent, but has left open whether it will appeal the ruling.
In the context of the Austrian ruling as well as considering the available guidance from the EDPB and the German Data Protection Conference, it can be noted that for the admissibility of ‘pay or okay’ models, which make the free use of an online service dependent on consent to the placing of advertising cookies, it is in any case necessary that the user can granularly control the data processing for other purposes (such as analytics) and to also refuse it without any disadvantages in terms of page access.
The ruling actually refers to the CMP on the Austrian news website krone.at as a positive example, where separate consent can be given for ‘advertising (consent required)’ on the one hand, and ‘web analytics and website optimisation’ and ‘loading external resources (including social embeds)’ on the other. A similar design can be found on the German news website Der Spiegel. In principle, therefore, it should be possible to implement these new requirements without jeopardising an online service’s financing through targeted advertising. However, Cookie Walls only remain of interest for websites with journalistic content.
(Dr. Lukas Mezger, UNVERZAGT Rechtsanwälte)