What happened
The Federal Administrative Court (BVwG) upheld the Austrian Data Protection Authority's 2024 decision that ORF.at's cookie banner violates the GDPR. The court ruled that the ‘Accept’ button must not be highlighted in colour and that ‘Accept’ and ‘Reject’ buttons must have equal prominence. ORF must redesign its banner to obtain valid, unambiguous consent.
Why it matters for trust and compliance
- Its status is decided. The case has an outcome that others may cite.
- The ruling clarifies that cookie consent mechanisms must offer equally prominent opt‑in and opt‑out options, impacting many online services.
- It relates to GDPR. The regulations library explains what that law requires.
Who is affected
media controller Austrian Broadcasting Corporation (ORF) ORF.at ORF (Austrian Broadcasting Corporation)
Recommended actions
- Review consent, cookie and tracking practices against the requirement.
- Check that privacy notices describe the practices this addresses.