Discuss your project

TOOLBOX · DOWNLOAD

Cookies only with genuine consent.

Cookie banners appear on almost every website, and European data protection authorities describe typical shortcomings: no reject option on the first layer, pre-ticked boxes, colors and contrasts that steer users toward consent. This checklist shows when consent is required under § 165 para. 3 TKG 2021 (Austrian Telecommunications Act 2021), what requirements the GDPR and the CJEU place on it, how European data protection authorities assess typical banner designs and how you can check your website yourself. At the end, it explains what the proposal for a Digital Omnibus would change.

Download PDF (7 pages)What Is Inside

Free PDF · Checklist

Cookie Banner: Checklist for Valid Consent

Topic
Website & Data Protection
Format
PDF, A4
Length
7 pages
Size
97 KB
Updated
Oct 25, 2026
Sources
9
Usage
Redistribution in unchanged form permitted
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

When consent is required, banner design, withdrawal, proof and technical checks, based on the TKG 2021, the GDPR, CJEU Planet49 and the positions of the EDPB.

  • Website owners and management of small and medium-sized companies
  • Marketing teams that use analytics and advertising services
  • Web agencies and developers who implement banners and tracking
  • Those responsible for data protection

7 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What applies

    TKG 2021, ePrivacy Directive, GDPR and the Planet49 judgment

  • 02

    When consent is required

    Strictly necessary or not: an overview of typical purposes

  • 03

    Banner design

    What data protection authorities object to in banners

  • 04

    Withdrawal and proof

    Withdraw at any time and be able to prove who consented and when

  • 05

    Technical checks

    How to check whether the banner really works

  • 06

    Common mistakes

    Typical shortcomings you should avoid

  • 07

    What could change

    The proposal for a Digital Omnibus on terminal equipment

EXCERPT

Banner design

  • Reject on the same layer as accept: the vast majority of authorities consider a banner without a reject option on the layer with the accept button to be a violation (Taskforce, type A).
  • No pre-ticked boxes, not even in the second-layer settings (Planet49; Taskforce, type B).
  • Reject not as an inconspicuous link in the body text or outside the banner without sufficient visual emphasis (Taskforce, type C).
  • No colors or contrasts that are obviously misleading, such as a reject button with practically illegible text; assessed case by case (Taskforce, types D and E).
  • Clearly recognizable what it is about, what purpose the consent serves and how to accept or reject; no impression that there is no access without consent (Taskforce, type C).
  • No cookie wall: access to content must not depend on accepting cookies (EDPB 05/2020, paras. 39 to 41).
  • Continuing to browse, scrolling or swiping is not consent (EDPB 05/2020, paras. 84 and 86).
  • Separate choice per purpose instead of bundled consent (EDPB 05/2020, para. 42).
  • Information in the banner or directly linked: data, legal basis, purposes, storage period (§ 165 para. 3 TKG 2021), duration of operation of the cookies and third-party access (Planet49).
  • Setting and reading never based on legitimate interest; no second reject for “legitimate interest” on deeper layers of the banner (Taskforce, type H, paras. 22 and 24).
Get the Full PDF

SOURCES

Supported
by Sources.

  1. Telekommunikationsgesetz 2021 (TKG 2021), § 165, current daily version in the RIS (opens in a new tab)§ 165 para. 3, accessed October 25, 2026
  2. Regulation (EU) 2016/679 (GDPR), German version on EUR-Lex (opens in a new tab)Art. 4(11), Art. 7, Recital 32, accessed October 25, 2026
  3. Directive 2002/58/EC (ePrivacy Directive), German version on EUR-Lex (opens in a new tab)Art. 5(3) as amended by Directive 2009/136/EC, accessed October 25, 2026
  4. CJEU, judgment of October 1, 2019, C-673/17 (Planet49) (opens in a new tab)Operative part nos. 1 to 3, accessed October 25, 2026
  5. EDPB: Guidelines 05/2020 on consent, version 1.1 (opens in a new tab)Paras. 39 to 42, 84, 86, 104 to 106, 113 to 115, accessed October 25, 2026
  6. EDPB: Report of the work undertaken by the Cookie Banner Taskforce (January 17, 2023) (opens in a new tab)Types A to K, paras. 22, 24 and 28, accessed October 25, 2026
  7. EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive, version 2.0 (opens in a new tab)Executive summary, use cases, accessed October 25, 2026
  8. Commission proposal for a Digital Omnibus Regulation, COM(2025) 837 (opens in a new tab)Proposed Art. 88a and 88b GDPR, Art. 5 and 11 of the proposal, accessed October 25, 2026
  9. European Parliament, Legislative Observatory: procedure 2025/0360(COD) (opens in a new tab)Procedural status on October 25, 2026

This checklist is a TOMORIS recommendation and does not replace legal advice. § 165 TKG 2021 and the GDPR in their current versions, as well as the decision in the individual case, are decisive. The positions of the Cookie Banner Taskforce and the EDPB guidelines are interpretive aids from the data protection authorities; national requirements apply in addition.

TOOLBOX

Explore
Further.

WEBSITE & DATA PROTECTION

More on
This Topic.

More free PDFs about Website & Data Protection.
All Website & Data Protection Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads