{"id":2538,"date":"2025-09-18T08:40:51","date_gmt":"2025-09-18T06:40:51","guid":{"rendered":"https:\/\/blog.eprivacy.eu\/?p=2538"},"modified":"2025-09-18T08:40:51","modified_gmt":"2025-09-18T06:40:51","slug":"austrian-court-rules-on-cookie-walls-for-websites-does-pay-or-okay-require-a-granular-consent-prompt","status":"publish","type":"post","link":"https:\/\/blog.eprivacy.eu\/?p=2538","title":{"rendered":"Austrian court rules on \u2018Cookie Walls\u2019 for websites: Does \u2018Pay or Okay\u2019 require a granular consent prompt?"},"content":{"rendered":"\n

A ruling<\/a> by the Austrian Federal Administrative Court (BVwG) on 13 August 2025 heralds a new round in the long dispute over the admissibility of so-called \u2018Pay or Okay\u2019 or \u2018Cookie Wall\u2019 practices in consent management on websites and in apps.

The court declared the specific implementation of the cookie banner (CMP) used by the newspaper Der Standard<\/a> to be unlawful, as the blanket consent option did not allow website visitors to consent or refuse consent in a granular manner to different processing purposes (advertising, profiling, analysis), contrary to the GDPR’s requirements for voluntary consent.

It is important to emphasise that the BVwG only criticised the lack of granularity with regard to consent, but did not declare the widespread practice itself to be incompatible with the requirement of voluntary consent, whereby free access to the website is made dependent on consent to the setting of advertising cookies in any case. These solutions, also known as \u2018Cookie Walls\u2019, can be found across Europe, for example, on the German news website spiegel.de.

About the granular consent requirement<\/strong>

Visitors to the website of Der Standard were given the choice of either taking out a paid subscription (\u2018pay\u2019) or agreeing to data processing for advertising, profiling, and analytics purposes by clicking on an \u201cagree\u201d button (\u2018okay\u2019). There was no differentiated selection of which of the various processing purposes \u2013 for web analysis, personalised advertising or social media plug-ins \u2013 one wished to consent to.

The data protection organisation NOYB, co-founded by data protection activist Max Schrems, had taken action against this design of the cookie banner.

According to the BVwG’s decision, the necessary granularity for effective consent was lacking. This requirement arises directly from the wording of the GDPR, according to which consent must be given \u2018for one or more specific purposes\u2019. In addition, recital 32 of the GDPR stipulates that, in principle, individual consents are required for multiple processing purposes. According to recital 43, consent is not freely given if it is only requested in a \u2018bundle\u2019, even though a separate request would be \u2018appropriate\u2019.

In the opinion of the BVwG, separate consent promts would have been \u2018appropriate\u2019 in this case, as according to the privacy policy, different purposes (functional, analytics, and advertising) were pursued. This assessment is also in line with the EDSA guidelines on consent<\/a> and the EDSA opinion 08\/2024<\/a> on \u2018consent or pay\u2019 models, which reject voluntary consent in the case of a bundle of different purposes without a separate selection option. The German Data Protection Conference <\/a>also requires a \u2018very close connection\u2019 between the purposes for pure subscription models with bundled purposes. In the present case, this connection did not exist to a sufficient degree.

According to the court, blanket consent as an alternative to a paid subscription does not constitute an appropriate balance between the fundamental rights concerned (data protection and entrepreneurial freedom); in particular, a purely economic interest cannot justify waiving the requirement for separate consent prompts.

The GDPR media exception does not apply<\/strong>

During the court proceeding, Der Standard also argued on the basis of the GDPR media exception, according to which journalistic work protected by fundamental rights may deviate from GDPR rules, for example with regard to consent requirements.

However, the court denied the applicability of media privilege, as the placing of advertising cookies or cookies for the integration of social media plugins, for example, do not serve journalistic purposes, but are rather intended to generate advertising revenue or transfer personal data to Google or Facebook.

Outlook and practical implications<\/strong>

The decision is not yet final; the right to an appeal has been granted. NOYB considers it likely<\/a> that the next instance would refer certain questions regarding the effectiveness of the users\u2019 consent options in Cookie Walls to the ECJ.

Der Standard has since announced that<\/a> it will implement the requirements set by the court regarding the granularity of consent, but has left open whether it will appeal the ruling.

In the context of the Austrian ruling as well as considering the available guidance from the EDPB and the German Data Protection Conference, it can be noted that for the admissibility of \u2018pay or okay\u2019 models, which make the free use of an online service dependent on consent to the placing of advertising cookies, it is in any case necessary that the user can granularly control the data processing for other purposes (such as analytics) and to also refuse it without any disadvantages in terms of page access.

The ruling actually refers to the CMP on the Austrian news website krone.at as a positive example, where separate consent can be given for \u2018advertising (consent required)\u2019 on the one hand, and \u2018web analytics and website optimisation\u2019 and \u2018loading external resources (including social embeds)\u2019 on the other. A similar design can be found on the German news website Der Spiegel. In principle, therefore, it should be possible to implement these new requirements without jeopardising an online service\u2019s financing through targeted advertising. However, Cookie Walls only remain of interest for websites with journalistic content.<\/p>\n\n\n\n

(Dr. Lukas Mezger, UNVERZAGT Rechtsanw\u00e4lte)<\/p>\n","protected":false},"excerpt":{"rendered":"

A ruling by the Austrian Federal Administrative Court (BVwG) on 13 August 2025 heralds a new round in the long dispute over the admissibility<\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts\/2538"}],"collection":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2538"}],"version-history":[{"count":1,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts\/2538\/revisions"}],"predecessor-version":[{"id":2539,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=\/wp\/v2\/posts\/2538\/revisions\/2539"}],"wp:attachment":[{"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eprivacy.eu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}