[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fse2LuvQlcSKUvXd5R2_mMUATDma0PyVU6JVXPkMC9h0":3},{"article":4,"iocs":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"fc491a54-59c7-4446-a51c-18d96bea6ceb","BVwG - W171 2303402-1\u002F7E","bvwg-w171-2303402-1-7e-5d8472","← Older revision Revision as of 07:56, 13 May 2026 Line 68: Line 68: }} }} The court upheld a DPA order requiring the Austrian public broadcaster to redesign its cookie banner, finding that visually highlighting the “Accept All Cookies” button nudged users towards consent and undermined its validity. A court upheld a DPA order requiring the Austrian public broadcaster to redesign its cookie banner, finding that visually highlighting the “Accept All Cookies” button unlawfully nudged users towards consent and undermined its validity. == English Summary == == English Summary == === Facts === === Facts === On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of [[Article 17 GDPR]] by the ORF (the controller). The data subject had also argued that the cookie banner did not offer an equivalent rejection option on the first layer and that refusing consent was more difficult than accepting it. On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject, represented by noyb, against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of [[Article 17 GDPR]] by the ORF (the controller). The data subject had also argued that the cookie banner did not offer an equivalent rejection option on the first layer and that refusing consent was more difficult than accepting it. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of [[Article 4 GDPR#11|Article 4(11) GDPR]]. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equivalent choice between \"Accept all cookies\" and \"Only necessary cookies, so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of [[Article 4 GDPR#11|Article 4(11) GDPR]]. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equivalent choice between \"Accept all cookies\" and \"Only necessary cookies, so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting.","On 28 October 2024, Austria's Data Protection Authority issued a decision against the Austrian public broadcaster ORF after finding its cookie banner design unlawfully nudged users toward accepting all cookies by visually highlighting the 'Accept All Cookies' button. The court upheld the DPA's order requiring ORF to redesign the banner within six weeks to ensure both consent and rejection options are equivalent in visual design, color, size, contrast, placement, and highlighting, to obtain valid consent under GDPR Article 4(11).","Austrian court upholds DPA order requiring ORF to redesign cookie banner with equivalent consent options.","Help BVwG - W171 2303402-1\u002F7E: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 15:57, 12 May 2026 view sourceDs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators44 editsmTag: Visual edit← Older edit Revision as of 07:56, 13 May 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators44 editsmTag: Visual editNewer edit → Line 68: Line 68: }}}} The court upheld a DPA order requiring the Austrian public broadcaster to redesign its cookie banner, finding that visually highlighting the “Accept All Cookies” button nudged users towards consent and undermined its validity.A court upheld a DPA order requiring the Austrian public broadcaster to redesign its cookie banner, finding that visually highlighting the “Accept All Cookies” button unlawfully nudged users towards consent and undermined its validity. == English Summary ==== English Summary == === Facts ====== Facts === On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of [[Article 17 GDPR]] by the ORF (the controller). The data subject had also argued that the cookie banner did not offer an equivalent rejection option on the first layer and that refusing consent was more difficult than accepting it.On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject, represented by noyb, against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of [[Article 17 GDPR]] by the ORF (the controller). The data subject had also argued that the cookie banner did not offer an equivalent rejection option on the first layer and that refusing consent was more difficult than accepting it. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of [[Article 4 GDPR#11|Article 4(11) GDPR]]. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equivalent choice between \"Accept all cookies\" and \"Only necessary cookies, so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of [[Article 4 GDPR#11|Article 4(11) GDPR]]. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equivalent choice between \"Accept all cookies\" and \"Only necessary cookies, so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting. Revision as of 07:56, 13 May 2026 BVwG - W171 2303402-1\u002F7E Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 4(11) GDPR Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 7(1) GDPR Article 58(2)(d) GDPR Decided: 23.04.2026 Published: Parties: Österreichischer Rundfunk - ORF National Case Number\u002FName: W171 2303402-1\u002F7E European Case Law Identifier: Appeal from: DSBD124.0507\u002F24 2024-0.633.166 Appeal to: Original Language(s): German Original Source: BVwG (in German) Initial Contributor: ds A court upheld a DPA order requiring the Austrian public broadcaster to redesign its cookie banner, finding that visually highlighting the “Accept All Cookies” button unlawfully nudged users towards consent and undermined its validity. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 28 October 2024, the DPA issued a decision concerning a complaint lodged by a data subject, represented by noyb, against the Austrian public broadcaster (Österreichischer Rundfunk – ORF). It dismissed the part of the data subject’s complaint concerning the request for erasure as it found no violation of Article 17 GDPR by the ORF (the controller). The data subject had also argued that the cookie banner did not offer an equivalent rejection option on the first layer and that refusing consent was more difficult than accepting it. Although the erasure complaint was dismissed, the DPA, acting on its own initiative within the same proceedings, examined the controller’s cookie banner. It found that its design could not lead to a freely given, specific, informed and unambiguous indication of the data subject’s wishes within the meaning of Article 4(11) GDPR. Accordingly, the DPA ordered the controller to amend its consent request for data processing within a period of six weeks in such a way that the data subject would be offered an equivalent choice between \"Accept all cookies\" and \"Only necessary cookies, so valid consent could be obtained. It stressed that it should be ensured that both options were equivalent in terms of visual design, including colour, size, contrast, placement, and highlighting. The controller appealed this decision on 25 November 2024. It claimed that the DPA’s order regarding the redesign of its cookie banner was unlawful. The controller argued that the authority had exceeded its jurisdiction by making an ex officio decision without informing it first of its intention. Furthermore, the controller argued that the GDPR does not lay down binding rules on the visual design of cookie banners and that the DPA had relied on non-binding guidance and literature rather than legally binding provisions. Holding Regarding the DPA’s jurisdiction in issuing the ex officio order for the modification of the controller’s cookie banner, the court held that this was permissible, both under Article 58(2)(d) GDPR and relevant CJEU case law, irrespective of whether the proceeding was initiated by a data subject’s complaint. The court maintained the position that when a DPA notices GDPR violations during its investigation, it is in its powers to adopt on its own initiative the appropriate measures to remedy the identified infringements. The court rejected the controller’s argument that its procedural rights were violated. It further stated that the controller was given the opportunity to comment on the ex officio matter and found that a lack of impartiality on the part of the DPA could not be established. Regarding the DPA’s order of redesign of the controller’s cookie banner, the court first noted that it had to assess whether the cookie banner allowed users to give valid consent within the meaning of Article 4(11) GDPR. It emphasised that consent requires a freely given, specific, informed and unambiguous indication of the user’s wishes and that, under Article 7(1) GDPR, the controller must be able to demonstrate that such consent was obtained. The court examined its latest version which had not changed since the DPA’s decision. It found that the controller’s website was designed is such a way that, when the site was accessed, a pop-up window opened displaying black text on a light grey background. On this cookie banner, there were","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W171_2303402-1\u002F7E&diff=51634&oldid=51631","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-05-13T07:56:28+00:00","2026-05-13T08:00:07.614339+00:00",7,[18,21],{"name":19,"type":20},"Österreichischer Rundfunk (ORF)","vendor",{"name":22,"type":23},"Cookie consent banner","technology","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":24,"icon":26,"name":27,"slug":28},null,"GDPR","gdpr",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[]]