Professional assessment, current as of end of May 2026. Not legal advice.
Why the German panic does not apply in Austria
In Germany, competitors and consumer associations can pursue data protection violations through competition law and send costly warning letters. It has become something of a small industry. Austria does not have this mechanism for GDPR violations. Here, enforcement rests with a single body, the Austrian Data Protection Authority (DSB). No lawyer will send you an invoice for 595 euros because your cookie banner is slightly off.
That sounds relaxed, and to some extent it is. The authority’s penalty rate has been modest: in 2023, of roughly 4,000 proceedings, only 55 ended in a fine, a rate of 1.4 percent. Anyone looking purely at the raw probability might lean back and not worry. They probably should not.
Three things that have changed the picture
Since 2024 the situation in Austria has tightened noticeably on three fronts at once. Anyone still working from the old understanding underestimates the risk.
- The penalty volume has jumped. In 2024 the authority imposed nearly 1.7 million euros in fines, up from just over a quarter million the year before, with roughly the same number of penalties. The count stayed similar; the amounts did not. Getting caught now costs more.
- The Court of Justice of the EU removed a safety valve. The DSB had capped complaints at two per person per month. In January 2025, the CJEU struck down that practice. Max Schrems, founder of noyb, commented drily.
- noyb can now file collectively. Since December 2024 the Vienna-based organisation has been recognised as a qualified entity and can bring EU-wide collective redress actions for the first time, including before Austrian civil courts, without waiting for the authority’s six-month deadline.
“You always have fundamental rights, not just twice a month.”
Max Schrems, noyb, January 2025
Three years for a decision, and why that is no comfort
There is a reason many operators feel safe: proceedings before the DSB take a long time. A very long time. The statutory six-month deadline is rarely more than an aspiration in practice; three years is not unusual even for a straightforward cookie banner case. Schrems has said openly that he has not seen a single proceeding that met the deadline.
Drawing the conclusion that you have years of peace and quiet anyway is a mistake. The violation continues during that period, and so does the risk. When the decision finally arrives, it covers the entire timeframe. And through the new collective action route the authority’s slow pace can be bypassed entirely, because civil courts are not bound by the same deadlines. The calm is borrowed, not given.
What a banner in Austria must do
The good news is that what the authority and the courts require is neither new nor complicated. The Federal Administrative Court has made clear in several rulings where most banners fall short. Rejecting cookies must be exactly as easy as accepting them, right on the first layer, not tucked away two clicks deep in a sub-menu. A brightly highlighted “Accept” button next to a faint grey “Reject” link is precisely the kind of design that is considered unlawful.
The reasoning comes down to a simple number: only about two percent of users ever open the second layer of a banner. Hiding the reject option there is a deliberate choice, and the authority and courts now treat it that way. Technically necessary cookies, such as those for a shopping basket, do not require consent. The consent requirement covers tracking, not the underlying technology.
It is the same regulatory logic as with the EU AI Act and the European Accessibility Act: an obligation with a date, enforced by a single body, without Germany’s warning-letter industry, but with teeth.
Whether your banner holds up takes five minutes to check
Most banners that become a problem fail at the same point: rejecting is made harder than accepting. That is something that can be checked and fixed cleanly, without legal drama. I will look at your banner and tell you whether it is on safe ground. Let’s talk.
Frequently asked questions
Can I receive a warning letter in Austria for an incorrect cookie banner?
Not in the German sense. Austria has no private warning-letter industry for data protection violations; enforcement sits with the DSB. A chargeable solicitor’s letter from a competitor about your banner is unusual here. That does not mean there is no risk, though.
How high is the real risk of a fine?
Statistically low, but rising. In 2023 just over one percent of proceedings ended in a fine. In 2024 the number of fines stayed similar, but the total volume climbed to nearly 1.7 million euros. Those who do get caught pay significantly more than before.
What must a cookie banner in Austria do?
Above all: rejecting must be just as easy as accepting, right on the first layer. A visually prominent accept button next to a hidden reject link is considered unlawful design. Technically necessary cookies need no consent; tracking does.
Is it true that DSB proceedings take years?
Yes, three years is not unusual even though the law provides for six months. That does not mean you are in the clear. The violation keeps running during that time, and the new collective action route bypasses the authority’s delays entirely because civil courts are not bound by those deadlines.
What has changed because of noyb?
The Vienna-based organisation has been recognised as a qualified entity since December 2024 and can bring EU-wide collective redress actions. This is a new route alongside the authority, one that will become most relevant for high-reach providers. For small businesses the risk remains limited for now, but worth watching.
Is a standard off-the-shelf banner enough?
Often not. Many ready-made banners are built around exactly the design that is now being challenged: a prominent accept and a hidden reject. What matters is not where the banner comes from but whether both options appear equally and on the first layer.
This article provides a professional assessment of the legal situation and does not replace individual legal advice.