to the point.

High efficiency. With a team of specialists.

The cookie ruling – The European way of surfing the web (ECJ Case C-673/17)


Cookies are an integral part of the Internet, used by website operators i.e. to recognise users and enable targeted advertising. Until the end of 2011, website operators used cookies within Europe without user's knowledge.

With the adoption of the Directive 2009/136/EC by the EU, this is no longer permissible. Website operators who offer their service in Austria are obliged to inform users comprehensively about the use of cookies and to obtain their consent before using them. In the event of breach, the website operator is penalised with an administrative fine of up to EUR 37,000,00. Austria implanted the Directive in § 96 Abs 3 Telekommunikationsgesetz (TKG) at the end of 2011.

Then the DSGVO was adopted and made it once again clear, that processing personal data is only permissible with the consent of the person concerned. Unlike the Directive, the DSGVO had direct legal force throughout Europe even without an implementing act.

Under these circumstances, informing the users in a footnote or imprint about the use of cookies was no longer enough. Website operators switched to the so-called "opt-out" method. With this method, users are informed via a banner that the website provider uses cookies. With closing or ignoring this “cookie banner”, the user has given his consent.

Now the European Court of Justice has ruled in Case C-673/17 that the consent of the user must take place expressly. The "opt-out" method is therefore not sufficient. The user must actively agree to the use of cookies. Even pre-selected boxes of consent are not sufficiently active consent since the User can overlook them and they do not provide any information about their will. Until the User has given his consent expressly, no cookies may be stored on the device.

Cookies covered by this explicit consent requirement are marketing and tracking cookies. It should also be noted, that storing data anonymously does not release a website provider from the obligation to obtain the user's consent.

The necessary first party cookies, such as shopping cart cookies or cookies for logins remain consent-free.

The ECJ has also ruled that the user must receive information on the duration of the function of the access rights of third parties to the data stored by cookies. These information obligations are in addition to the already existing information obligations of Art 10 Directive 95/46/EC.

Währinger Straße 2-4, 1090 Wien | + 43 1 319 45 20 |