Cookie Banner: Checklist for Valid Consent

In Austria, § 165 para. 3 TKG 2021 transposes Art. 5(3) of the ePrivacy Directive. Providers of an information society service must provide information on which personal data they process, on what legal basis, for what purposes and for how long; collection is only permitted if the user has actively consented on the basis of clear and comprehensive information. Exempt are storage and access whose sole purpose is the transmission of a communication or that are strictly necessary for the provider to supply a service explicitly requested by the user.

National law implementing the ePrivacy Directive applies to setting and reading cookies, and the GDPR applies to the subsequent processing. Setting or reading cannot be based on legitimate interest, and if consent required under § 165 para. 3 TKG 2021 is missing, the subsequent processing cannot be lawful either (EDPB, report of the Cookie Banner Taskforce, para. 24).

You must be able to justify classifying something as “necessary.” The Taskforce discussed that website operators should keep lists of their cookies, present them to the authorities on request and demonstrate their necessity (para. 28). The classification of statistics is a TOMORIS recommendation based on the wording of the law.

• Reject on the same layer as accept: the vast majority of authorities consider a banner without a reject option on the layer with the accept button to be a violation (Taskforce, type A).
• No pre-ticked boxes, not even in the second-layer settings (Planet49; Taskforce, type B).
• Reject not as an inconspicuous link in the body text or outside the banner without sufficient visual emphasis (Taskforce, type C).
• No colors or contrasts that are obviously misleading, such as a reject button with practically illegible text; assessed case by case (Taskforce, types D and E).
• Clearly recognizable what it is about, what purpose the consent serves and how to accept or reject; no impression that there is no access without consent (Taskforce, type C).
• No cookie wall: access to content must not depend on accepting cookies (EDPB 05/2020, paras. 39 to 41).
• Continuing to browse, scrolling or swiping is not consent (EDPB 05/2020, paras. 84 and 86).
• Separate choice per purpose instead of bundled consent (EDPB 05/2020, para. 42).
• Information in the banner or directly linked: data, legal basis, purposes, storage period (§ 165 para. 3 TKG 2021), duration of operation of the cookies and third-party access (Planet49).
• Setting and reading never based on legitimate interest; no second reject for “legitimate interest” on deeper layers of the banner (Taskforce, type H, paras. 22 and 24).

• Withdrawal possible at any time and as easy as giving consent (Art. 7(3) GDPR); anyone who consents with one click must be able to withdraw just as easily (EDPB 05/2020, para. 114).
• Withdrawal through the same interface through which consent was given, i.e. on the website itself, not through another channel such as a telephone hotline (EDPB 05/2020, para. 114 f.).
• Easily accessible way back to the settings, such as a permanently visible icon or a link in a clearly visible, customary place; no specific solution is prescribed (Taskforce, type K).
• Users informed of the right to withdraw before giving consent (Art. 7(3) GDPR).
• Consents stored in a verifiable way: time, banner version, selected purposes; however, the obligation to demonstrate consent should not lead to excessive additional data processing (Art. 7(1) GDPR, EDPB 05/2020, paras. 104 to 106).

1. 1

   Load without deciding

   Open the website in a private browser window and watch storage and network requests in the developer tools without interacting with the banner. No cookies requiring consent may be set and no requests may be sent to tracking services; by default, none of this may be set without consent (Taskforce).

2. 2

   Reject

   Choose reject and switch pages: there must still be no cookies requiring consent or tracking requests.

3. 3

   Partial consent

   Select only one purpose, such as statistics: only the cookies and services for that purpose may become active.

4. 4

   Withdraw

   Withdraw consent via the icon or link and check that no services requiring consent load afterward.

5. 5

   Document

   Keep a list of all cookies and similar technologies with purpose, provider and lifetime, and update it when the website changes (TOMORIS recommendation; the Taskforce discussed such lists and presenting them to authorities, para. 28).

The TOMORIS cookie check reads the cookies your server sets on the first visit and reports, among other things, analytics cookies without consent. Also check cookies that are only set in the browser by JavaScript, as well as third-party requests, in the browser as described above.

• Only “Accept all” and “Settings,” but no “Reject” on the first layer.
• Tracking scripts load before a decision has been made.
• Analytics or marketing cookies classified as “necessary.”
• All purposes are preselected in the settings.
• A banner that can no longer be reached after a one-time decision, so that withdrawal is not possible.
• The subsequent processing is based on “legitimate interest,” which users must additionally reject on a second layer.

According to the EDPB, the Taskforce positions are a minimum threshold for assessing complaints and not an approval by an authority; national requirements apply in addition.

The Commission proposal COM(2025) 837 would move the storing and reading of personal data on the terminal equipment of natural persons into the GDPR (new Art. 88a); for other information, the ePrivacy Directive would remain decisive. It would have to be possible to reject consent requests with a single button; after a rejection, consent for the same purpose could not be requested again for at least six months. Permitted without consent would be, among other things, aggregated audience measurement exclusively for the provider’s own use and security purposes. Under a new Art. 88b, websites would have to accept and respect consent and rejection also as machine-readable signals, according to the proposal 24 months after entry into force and not for media services; web browsers would have to support such signals after 48 months.

This is a proposal, not applicable law: on October 25, 2026, procedure 2025/0360(COD) in the European Parliament was awaiting the committee decision. Until the changes apply, according to the proposal no earlier than six months after publication or entry into force, § 165 para. 3 TKG 2021 remains decisive.