# Cookies in Austria: § 165 TKG 2021 explained

> What § 165(3) TKG 2021 requires for cookies and tracking: consent, exceptions, interplay with the GDPR and who supervises in Austria.

Quelle: https://whovisit.app/en/blog/cookies-austria-section-165-tkg-2021
Veröffentlicht: 2026-11-07
Herausgeber: Whovisit (ARAVILO, Innsbruck)

Austria has no cookie section of its own in the Data Protection Act. The rule is in the Telecommunications Act 2021 (TKG 2021) and therefore easily slips through the net. This article explains what § 165(3) TKG 2021 requires, which exceptions apply and how the provision interacts with the GDPR.

## What the law says

The text of § 165 Abs. 3 TKG 2021 is in the [Legal Information System of the Federal Government](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011678&Paragraf=165). It contains two obligations for providers of an information society service, which includes website operators:

1. **Information.** You must inform the user which personal data you process, on which legal basis, for which purposes and how long the data is stored.
2. **Consent.** Collecting this data is permitted only if the user has given consent actively and on the basis of clear and comprehensive information.

The provision implements Art. 5(3) of the ePrivacy Directive. For companies in Germany, the parallel rule in [§ 25 TDDDG](https://whovisit.app/blog/tdddg-paragraf-25-cookies) applies.

## Which technology falls under it?

The text of the law does not mention cookies. The Austrian Data Protection Authority (DSB) reads the provision broadly in its [FAQ on cookies](https://dsb.gv.at/dam/jcr:a6ebcf0b-0874-4aa5-b88d-f79bcce5330c/DSB%20FAQ%20zum%20Thema%20Cookies%20und%20Datenschutz.pdf): on this reading it covers storing information in the end device and accessing it, not just cookies. That includes comparable technologies such as the browser's local storage.

There is also a narrower reading. It relates the wording ("collecting this data") to personal data and thereby narrows the scope. In practice this is a risk, not a free pass. Anyone relying on the narrow reading should discuss it with their data protection adviser.

## The exceptions

No consent is needed if

- the sole purpose is carrying out the transmission of a message over a communications network, or
- the storage or access is strictly necessary so that the provider can supply a service expressly requested by the user.

Both are narrowly drawn. According to the DSB, technically necessary cookies need no consent. Neither the Directive nor the TKG 2021 supplies a list, however, and the DSB relies on criteria of the former Article 29 Data Protection Working Party. In its view, tracking cookies do not count. Typical cases without prior consent are the shopping basket, login and storing the banner decision. Analytics and marketing tools generally do not fall under this.

## Interplay with the GDPR

Two tests apply side by side, as in the rest of the EU:

| Test | Question | Governing rule |
|---|---|---|
| 1. End device | Is anything stored on or read from the device? | § 165 Abs. 3 TKG 2021 |
| 2. Processing | Is there a legal basis for the data? | Art. 6 GDPR |

Passing the first step does not replace the second. Anyone who obtains consent for the script can often also use it as a basis under Art. 6(1)(a) GDPR. When legitimate interest holds up instead is covered in [Legitimate interest under the GDPR: the 3 steps of the test](https://whovisit.app/blog/berechtigtes-interesse-dsgvo).

## Who supervises and what is at stake

According to the DSB's FAQ, enforcement of violations of § 165 Abs. 3 TKG 2021 lies with the telecommunications authorities. The DSB may be responsible if the use also processes personal data, for example when profiles are built. For GDPR violations, the fines under Art. 83 GDPR apply.

The TKG 2021 itself provides in § 188 Abs. 4 Z 24 for an administrative penalty of up to 50,000 euros if users are not informed contrary to § 165 Abs. 3. For the case of missing consent, this provision names no penalty of its own. That does not mean a violation goes without consequences, because the GDPR applies alongside.

## Checklist for Austria

1. List all scripts, pixels and storage accesses of your website.
2. Sort them into "strictly necessary" and "everything else".
3. Load everything else only after active consent.
4. Inform in the privacy policy and banner about data, basis, purpose and storage period.
5. Offer rejecting and withdrawing as easily as accepting.

## Frequently asked questions

**Does § 165(3) TKG 2021 also apply to German companies?** That depends on the individual case, for example where your company is based and to whom the offer is directed. Clarify this with your data protection adviser. In Germany, § 25 TDDDG applies, and in both countries the practice is the same: non-necessary scripts only after consent.

**Is a notice "By using the site you agree" enough?** No. The law requires active consent. Merely continuing to use the page is not an active act.

**Is Switzerland similarly strict?** No, a different model applies there, with information and an option to refuse. This is explained in [Website tracking in Switzerland: revDSG and FMG](https://whovisit.app/blog/website-tracking-schweiz-revdsg).