AUSTRIA

Moderate Court ruling Decided Austria · Sep 1, 2026

Austrian Supreme Court rules CRIF’s use of address‑publisher data for credit scoring violates GDPR purpose limitation

The Austrian Supreme Court (OGH) held that credit reference agencies may not collect personal data from address publishers that process the data for marketing purposes, confirming a GDPR purpose‑limitation breach. The ruling supports…

EDPB · General Data Protection Regulation

Low Enforcement Filed Austria · Jul 30, 2026

noyb files GDPR complaint against dict.cc over 1,741‑partner consent banner

noyb lodged a complaint with the Austrian Data Protection Authority alleging that dict.cc’s cookie banner forces users to consent to tracking by 1,741 partner companies with a single click, violating GDPR consent requirements. The…

Austrian Data Protection Authority · General Data Protection Regulation

Low Enforcement Filed Austria · Jun 9, 2026

noyb files injunction against Austrian credit agency CRIF over GDPR violations

noyb, a state‑approved qualified entity, filed an injunction against CRIF to stop its alleged unlawful collection and scoring of personal data under the GDPR. The filing also suspends the limitation period and prepares a subsequent class…

EDPB · General Data Protection Regulation

Low Court ruling Decided Austria · May 21, 2026

Austrian Federal Administrative Court orders ORF to redesign cookie banner for equal consent options

The Federal Administrative Court (BVwG) upheld the Austrian Data Protection Authority's 2024 decision that ORF.at's cookie banner violates the GDPR. The court ruled that the ‘Accept’ button must not be highlighted in colour and that…

EDPB · General Data Protection Regulation

Low Enforcement Filed Austria · May 5, 2026

LinkedIn blocks GDPR access to profile visitor data behind paywall, noyb files complaint in Austria

LinkedIn requires users to pay to view who has visited their profile, despite the data being personal under the GDPR. noyb argues the data must be provided free of charge under Article 15 and has lodged a complaint with the Austrian Data…

Austrian Data Protection Authority · General Data Protection Regulation

Moderate Data protection authority action Decided Austria · Jan 27, 2026

Austrian DSB orders Microsoft to stop tracking school children with cookies

The Austrian Data Protection Authority ruled that Microsoft illegally installed tracking cookies on a pupil's device without consent. The authority ordered Microsoft to cease the use of those cookies within four weeks. The decision follows…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Investigation Announced Austria · Jan 20, 2026

noyb investigation reveals Austrian credit agency CRIF uses public registers for mass address data collection

noyb’s investigation of CRIF shows that most address data comes from brokers who scrape public registers, violating GDPR purpose‑limitation. The Austrian DSB has already ruled that further processing for advertising breaches the GDPR.

Austrian Data Protection Authority · General Data Protection Regulation

Moderate Court ruling Decided Austria · Dec 18, 2025 · deadline Dec 31, 2025

Austrian Supreme Court orders Meta to give users full data access within 14 days

The Austrian Supreme Court ruled that Meta must provide a complete copy of all personal data to any user request within 14 days, including source, recipient and purpose information. The court also required Meta to obtain explicit opt‑in…

EDPB · General Data Protection Regulation

Low Enforcement Filed Austria · Dec 17, 2025

noyb files complaints against TikTok, AppsFlyer and Grindr with Austrian DSB over unlawful tracking

noyb has lodged two complaints with Austria's data protection authority alleging that TikTok tracks users across other apps and fails to provide a complete copy of personal data. The complaints also target AppsFlyer and Grindr for sharing…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Enforcement Filed Austria · Oct 28, 2025

noyb files criminal complaint against Clearview AI in Austria

noyb filed a criminal complaint with Austrian public prosecutors against Clearview AI and its managers for alleged GDPR violations. The complaint relies on Article 84 GDPR and Austria's § 63 Data Protection Act, which allow criminal…

Austrian public prosecutors · General Data Protection Regulation

Moderate Data protection authority action Decided Austria · Oct 9, 2025

Austrian DSB rules Microsoft 365 Education illegally tracks students and orders data deletion

The Austrian Data Protection Authority found Microsoft 365 Education used tracking cookies without consent and denied a data‑access request, violating GDPR. The DSB ordered Microsoft to delete the data, provide full access, and disclose…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Data protection authority action Published Austria · Sep 26, 2025

Austrian DSB bans KSV1870 from automated credit checks without consent

The Austrian Data Protection Authority ruled that KSV1870's fully automated credit rating was unlawful and prohibited the agency from conducting such checks without the data subject's consent. The authority also ordered KSV1870 to provide…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Investigation Announced Austria · Sep 25, 2025

noyb uncovers over 40,000 CRIF credit queries linking Austrian banks, telecoms and retailers

noyb obtained data requests from 2,440 individuals and analyzed more than 40,000 CRIF credit queries, finding that banks, telecoms and other firms provide personal address data to the credit agency. The analysis shows gender and geographic…

EDPB · General Data Protection Regulation

Low Enforcement Announced Austria · Sep 18, 2025

NGOs file EU Commission complaint over Austrian DPA budget cuts

The Austrian Data Protection Authority (DSB) announced further restrictions due to significant budget cuts. NGOs epicenter.works and noyb plan to file a complaint with the European Commission alleging violation of Article 52(4) GDPR. The…

European Commission · General Data Protection Regulation

Moderate Data protection authority action Decided Austria · Aug 29, 2025

Austrian DPA orders YouTube to comply with GDPR Article 15 access request

The Austrian Data Protection Authority issued a decision ordering YouTube (Google) to provide the complainant with full access to his personal data, including purpose, storage periods, recipients and tracking cookies, under Article 15…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Court ruling Decided Austria · Aug 18, 2025

Austrian Federal Administrative Court rules DerStandard's "pay or okay" consent model illegal

The Austrian Federal Administrative Court (BVwG) confirmed the Data Protection Authority's finding that DerStandard violated the GDPR by offering a "pay or okay" choice. The court held that the newspaper did not obtain valid, granular…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Data protection authority action Filed Austria · Jun 26, 2025

noyb files complaint against Bumble for unlawful AI Icebreakers in Austria

noyb lodged a complaint with the Austrian Data Protection Authority alleging that Bumble's AI Icebreakers process personal data without valid consent and rely on an invalid legitimate‑interest claim. The complaint cites violations of GDPR…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Class action Announced Austria · Jun 3, 2025

noyb seeks participants for potential GDPR class action against Austrian credit agency CRIF

noyb alleges that CRIF processes personal data of millions of Austrians to calculate credit scores based on age, gender and address, potentially violating the GDPR. The organization plans a scientific review and, if evidence supports it…

Austrian Data Protection Authority · General Data Protection Regulation

Low Enforcement Filed Austria · Apr 24, 2025

noyb files GDPR complaint against Ubisoft for forced online tracking of offline games

noyb lodged a complaint with the Austrian Data Protection Authority alleging that Ubisoft requires players to be online for single‑player games, collecting personal data such as start time, duration and quit time. The complaint argues the…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Court ruling Decided Austria · Jan 9, 2025

CJEU rules Austrian DPA cannot limit data subject complaints to two per month

The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Filed Austria · Sep 25, 2024

noyb files complaint against Mozilla over default ‘Privacy Preserving Attribution’ feature in Firefox

noyb lodged a complaint with the Austrian Data Protection Authority alleging that Mozilla enabled a ‘Privacy Preserving Attribution’ feature in Firefox by default without informing users or obtaining consent. The feature allows Firefox to…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Data protection authority action Filed Austria · Aug 29, 2024

noyb files complaint with Austrian DPA over automated credit checks by KSV1870 and Unsere Wasserkraft

noyb lodged a complaint with the Austrian Data Protection Authority against credit reference agency KSV1870 and energy supplier Unsere Wasserkraft. The complaint alleges that customers are subjected to fully automated credit checks that…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Filed Austria · Jun 13, 2024

noyb files complaint with Austrian DPA over Google Chrome consent pop‑up

noyb alleges that Google Chrome’s “Privacy Sandbox” pop‑up misleads users into consenting to first‑party tracking for targeted advertising. The complaint asks the Austrian data protection authority to require Google to cease processing…

Austrian Data Protection Authority · General Data Protection Regulation

Low Enforcement Filed Austria · Jun 5, 2024

noyb files GDPR complaint against Austrian newspaper Kurier over forced consent

noyb lodged a GDPR complaint against Kurier for forcing users to accept tracking cookies. The Austrian DSB had previously banned the same practice at Profil and ordered compliance, which was not implemented. On 20 August 2024 the DSB…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Investigation Announced Austria · Jun 4, 2024

noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children

noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Filed Austria · Apr 29, 2024

noyb files complaint with Austrian DPA over OpenAI's ChatGPT inaccurate personal data

noyb filed a complaint with the Austrian Data Protection Authority alleging that OpenAI cannot correct inaccurate personal data generated by ChatGPT, violating GDPR Articles 5, 15 and 16. The complaint seeks an investigation, compliance…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Filed Austria · Jan 11, 2024

Meta sued for charging users to withdraw consent in Austria

Noyb filed a complaint with the Austrian Data Protection Authority alleging that Meta forces users to pay up to €251.88 per year to withdraw consent for tracking. The complaint cites Article 7 of the GDPR, which requires withdrawal to be…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Filed Austria · Jan 4, 2024

noyb files complaint against Austrian creditors’ association KSV1870 for charging for GDPR Article 15 access

noyb lodged a complaint with the Austrian data protection authority alleging that KSV1870 charges €43 for a data‑access service that must be provided free of charge under Article 15 GDPR. The organization allegedly uses misleading website…

Austrian Data Protection Authority · General Data Protection Regulation

Low Lawsuit filed Filed Austria · Dec 4, 2023

noyb sues CRIF and AZ Direct for illegal secret data processing in Austria

noyb filed a lawsuit in the Vienna Regional Court on behalf of seven individuals alleging that CRIF GmbH and address trader AZ Direct secretly trade personal data of millions of Austrians for credit scoring. The Austrian Data Protection…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Enforcement Filed Austria · Nov 28, 2023

noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee

noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…

Austrian Data Protection Authority · General Data Protection Regulation

Low Court ruling Decided Austria · Oct 9, 2023

Austrian court orders streaming service DAZN to comply with GDPR access request after 5 years

The Austrian Federal Administrative Court ruled on 6 September 2023 that DAZN must provide the missing information requested under the GDPR right of access. DAZN complied with the court order on 13 September 2023, completing the request…

Austrian Data Protection Authority · General Data Protection Regulation

Moderate Data protection authority action Decided Austria · May 10, 2023

Austrian DPA deems Clearview AI’s biometric data processing illegal, orders deletion, no fine

The Austrian Data Protection Authority ruled that Clearview AI may not process the complainant’s biometric data and must delete the data. The decision cites GDPR violations for scraping and selling personal data of Europeans. No monetary…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Interpretation Published Austria · Apr 11, 2023

Austrian DPA says "Pay or Okay" cookie paywalls must allow specific consent

The Austrian Data Protection Authority partially reversed its earlier stance on the "Pay or Okay" model used by Der Standard, confirming its general permissibility but requiring that users be able to say "yes" or "no" to each specific data…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Data protection authority action Decided Austria · Mar 27, 2023

Austrian DPA rules CRIF's processing of Austrian citizens' personal data illegal

The Austrian Data Protection Authority found that CRIF GmbH illegally processed addresses, dates of birth, names and other personal data of millions of Austrians obtained from AZ Direkt without consent or legal basis, ordering the deletion…

Austrian Data Protection Authority · General Data Protection Regulation

Moderate Court ruling Decided Austria · Mar 17, 2023

Austrian Federal Administrative Court allows mobile providers to refuse access requests for location data without proof of exclusive use

The Austrian Federal Administrative Court (BVwG) ruled that A1 Telekom Austria may deny a data subject's request for traffic and location data unless the subject can prove exclusive use of the phone. The court deemed location data…

EDPB · General Data Protection Regulation

Low Enforcement Published Austria · Mar 16, 2023

Austrian DSB declares Meta tracking tools illegal under GDPR

The Austrian Data Protection Authority ruled that Meta's tracking pixel, Facebook Login and Meta Pixel violate the GDPR and the Schrems II decision on transatlantic data transfers. The decision advises EU website operators not to use any…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Published Austria · Feb 6, 2023

Austrian DSB rules credit bureau KSV 1870 may not collect data via access requests and civil registries

The Austrian Data Protection Authority found KSV 1870's practice of storing information obtained through GDPR access requests and civil‑registry comparisons illegal, violating purpose‑limitation under Article 5(1)(b) GDPR. The DSB ordered…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Low Enforcement Decided Austria · Oct 20, 2022

Austrian DSB orders Profil.at to fix forced cookie banners after GDPR complaint

noyb filed a GDPR complaint against Profil.at for using a forced two‑step cookie consent mechanism. The Austrian Data Protection Authority issued a decision on 10 August 2023, confirming the violations and giving the site an eight‑week…

Austrian Data Protection Authority (DSB) · General Data Protection Regulation

Moderate Interpretation Published Austria · May 2, 2022

Austrian DPA rejects risk‑based approach for EU‑US data transfers, deems Google IP anonymisation insufficient

The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does…

Austrian Data Protection Authority · General Data Protection Regulation

Low Enforcement Published Austria · Jan 13, 2022

Austrian DSB rules EU‑US transfers to Google Analytics illegal under GDPR

The Austrian Data Protection Authority (DSB) decided that the continuous use of Google Analytics violates the GDPR following the Schrems II ruling. The DSB rejected Google's claimed technical and organisational measures as ineffective…

Austrian Data Protection Authority (Datenschutzbehörde) · California Delete Act