Austria: Federal Administrative Court issued ruling against publishers of Der Standard media group over "pay-or-consent" mechanism violations

On 13 August 2025, the Federal Administrative Court of Austria upheld the Data Protection Authority's decision finding that Der Standard media group violated General Data Protection Regulation (GDPR) consent requirements through their "pay or okay" cookie mechanism. The ruling stated that websites must provide granular consent options rather than forcing users to accept all data processing purposes including analytics, advertising, social media) through a single "AGREE" button, even when offering paid advertisement-free alternatives. The court determined that bundled consent mechanisms are invalid under GDPR, and that Transparency and Consent (TC)-Strings combined with Internet Protocol addresses constitute personal data. It also provided that journalistic activities don't exempt cookie-based advertising from consent requirements. The Data Protection Authority is required to conduct further proceedings on remedial measures, with this precedent-setting decision addressing legally significant questions about consent granularity that impact GDPR enforcement across the European Union.