Mandatory Website Information in Austria: Imprint, Disclosure, Privacy Policy and Cookies

“Imprint” is an umbrella term for information required by several laws: § 5 ECG applies to every service provider, meaning anyone who provides an information society service; this expressly includes online information services and online advertising (§ 3 nos. 1 and 2 ECG). § 14 UGB applies to entrepreneurs registered in the commercial register, § 63 GewO to traders without a commercial register entry. The disclosure under § 25 MedienG (Austrian Media Act) applies to every website; its scope depends on the content. In addition, there is the privacy policy under Art. 13 GDPR and the cookie rule in § 165 para. 3 TKG 2021.

Combining is allowed: the disclosure may appear together with the information under § 5 ECG (§ 25 para. 1 MedienG), so a single “Imprint” page is sufficient. The WKO (Austrian Economic Chamber) applies § 5 ECG to all commercially operated websites, even without a shop, and recommends a separate privacy policy for data protection.

The WKO recommends always naming the trade authority as the supervisory authority and, as a rule, the Gewerbeordnung as the professional regulations, with a link to the RIS.

An accessible website is a periodic electronic medium (§ 1 para. 1 no. 5a lit. b MedienG). Its media owner (§ 1 para. 1 no. 8 lit. c), usually the operating company, provides the information so that it can be found “permanently, easily and directly” (§ 25 para. 1).

A shortened disclosure is permitted for websites without informational content that goes beyond presenting the owner’s personal life or presenting the media owner and that is capable of influencing public opinion (§ 25 para. 5). According to the WKO, this applies to websites that only promote the company, its services and products, including a simple web shop; opinion-forming content beyond that makes them a large website.

Newsletters that appear at least four times per calendar year in a comparable format (§ 1 para. 1 no. 5a lit. c) need an imprint with the name or company name and address of the media owner and publisher (§ 24 para. 3) and the web address of the disclosure or the disclosure itself (§ 25 para. 1).

TOMORIS recommendation: if you have a blog, magazine or news section with content that goes beyond your own offering, make a full disclosure when in doubt, including the editorial policy, for example “Information about the services of [Company] and expert articles on [Topics].”

If the website collects personal data from visitors, the controller provides the following information at the time of collection (Art. 13(1) and (2) GDPR), in a concise, transparent, intelligible and easily accessible form, using clear and plain language (Art. 12(1)). The information under § 165 para. 3 TKG 2021 about data, legal basis, purposes and storage period fits into the same privacy policy.

• Name and contact details of the controller and, where applicable, its representative (Art. 13(1)(a))
• Contact details of the data protection officer, if there is one (Art. 13(1)(b))
• Purposes and legal basis of each processing operation, such as contact form or newsletter (Art. 13(1)(c))
• The legitimate interests, if processing is based on Art. 6(1)(f) (Art. 13(1)(d))
• Recipients or categories of recipients, such as hosting or newsletter service (Art. 13(1)(e))
• Transfer to a third country, including adequacy decision or safeguards (Art. 13(1)(f))
• Storage period or the criteria used to determine it (Art. 13(2)(a))
• Access, rectification, erasure, restriction, objection, data portability (Art. 13(2)(b))
• Where consent is the basis: the right to withdraw it at any time (Art. 13(2)(c))
• Right to lodge a complaint with a supervisory authority (Art. 13(2)(d))
• Whether data must be provided and the consequences of not providing it (Art. 13(2)(e))
• Automated decision-making, including profiling, if used (Art. 13(2)(f))

§ 165 para. 3 TKG 2021 transposes Directive 2002/58/EC (§ 1 para. 6 no. 5 TKG 2021). Providers of an information society service inform users about the personal data they process; they may only collect it if the user has actively consented on the basis of clear and comprehensive information. Without consent, technical storage or access is only permitted if its sole purpose is the transmission of a communication or if it is strictly necessary for the provider to supply a service explicitly requested by the user, such as a shopping cart. The provision contains no exception for audience measurement or advertising. Since personal data is processed on the basis of consent, Art. 4(11) and Art. 7 GDPR also apply.

• Before consent, only cookies and scripts that fall under one of the two exceptions load.
• The banner states the data, purposes, legal basis and storage period in advance (§ 165 para. 3 TKG 2021).
• Consent only through an active action, no pre-ticked boxes (Recital 32 GDPR).
• Consent for each purpose, for example separately for statistics and marketing (Recitals 32 and 43 GDPR).
• Before consent is given, the notice that it can be withdrawn at any time is shown (Art. 7(3)).
• Withdrawal as easy as consent, for example via “Cookie settings” in the footer (Art. 7(3)).
• Consents are logged in a verifiable way (Art. 7(1) GDPR).
• Rejecting is as easy as accepting on the first layer of the banner.
• After changes to plugins or the tag manager, check again what loads before consent.

The checklist is a TOMORIS recommendation; legally required are information, active consent and the two exceptions (§ 165 para. 3 TKG 2021) as well as Art. 7 GDPR. The TOMORIS cookie check shows which cookies the server sets on the first visit; the browser’s developer tools show those set by JavaScript.

Pending: the European Commission’s Digital Omnibus of November 19, 2025 (COM(2025) 837) proposes a new Art. 88a GDPR: exceptions, for example, for aggregated audience measurement for the provider’s own use and for security, one-click rejection and, after a rejection, no new request for the same purpose for at least six months. According to the European Parliament, procedure 2025/0360(COD) is still awaiting committee decision as of October 25, 2026. Until it is amended, § 165 para. 3 TKG 2021 applies.

• Make advertising, promotional gifts, prize competitions and sweepstakes clearly identifiable as such, with the client identifiable, and make the conditions easily accessible (§ 6 para. 1 ECG).
• Online shop: provide information in advance on the technical steps, storage of the contract text, correction of input errors, languages and codes of conduct (§ 9 ECG), allow corrections and confirm receipt of the order electronically without undue delay (§ 10), and provide the terms and conditions in a form that can be stored (§ 11).
• Label paid content as “Anzeige” (advertisement), “entgeltliche Einschaltung” (paid insertion) or “Werbung” (advertising) if the design or placement does not rule out doubt (§ 26 MedienG as amended by BGBl. I No. 21/2026, since May 1, 2026).
• ODR platform: Regulation (EU) No 524/2013 was repealed on July 20, 2025 (Art. 1 Regulation (EU) 2024/3228); the WKO advises deleting the link to the platform.

Sole proprietors without a commercial register entry state their name and the location of the trade license instead of the company name, legal form and commercial register data (§ 63 para. 1 GewO); for a GmbH & Co KG, the information is given for both the KG and the GmbH (§ 14 para. 1 UGB).

Imprint and disclosure
Information under § 5 ECG, § 14 UGB and § 25 MedienG

Media owner and service provider: [Company name per commercial register]
Legal form: Gesellschaft mit beschränkter Haftung (limited liability company)
Registered office: [Place per commercial register]
Address: [Street and number, postal code and city, Austria]
Phone: [Phone number], email: [Email address]
Commercial register number: [FN number], commercial register court: [Court]
VAT ID number: [VAT ID number]
Business purpose: [e.g. IT services]
Chamber: member of the [Economic Chamber, trade group]
Professional title: [if applicable, with state in which it was granted]
Professional regulations: [Gewerbeordnung 1994], www.ris.bka.gv.at
Supervisory authority: [competent trade authority]

Only if the website goes beyond presenting the company
(§ 25 paras. 2 to 4 MedienG):
Management: [Name, role]; supervisory board: [Names]
Shareholders: [Name, share, indirect and silent holdings]
Basic orientation: [Editorial policy]

• Delete lines that do not apply, such as supervisory authority, professional title or VAT ID number.
• If you state the share capital and not all cash contributions have been paid in, add the total amount of outstanding contributions (§ 14 para. 2 UGB); in liquidation, add a notice to that effect (§ 14 para. 1 UGB).

• The “Imprint” link appears in the footer of every page, including the shop, blog and landing pages.
• Company name, legal form, registered office and commercial register data match the commercial register (§ 14 para. 1 UGB).
• Address and contact details, including email, are provided (§ 5 para. 1 nos. 2 and 3 ECG).
• Where applicable: chamber, professional regulations, supervisory authority, VAT ID number (§ 5 para. 1 nos. 5 to 7 ECG).
• It is recorded whether the website is small within the meaning of § 25 para. 5 MedienG.
• Newsletters contain an imprint and the web address of the disclosure (§ 24 para. 3, § 25 para. 1 MedienG).
• After every change in the commercial register, the imprint and disclosure are updated.
• Annual review of imprint, privacy policy and banner: [Name, role], last on [MM/DD/YYYY].

The checklists in this document are TOMORIS recommendations. Legally required is the information that the legal references cited in each case demand.

• Only a contact form, no email address, although § 5 para. 1 no. 3 ECG requires one.
• GmbH & Co KG without information on the GmbH as the partner with unlimited liability (§ 14 para. 1 UGB).
• Blog with opinion-forming content, but only a shortened disclosure (§ 25 paras. 2 to 5 MedienG).
• Privacy policy without the embedded services or without the storage period (Art. 13 GDPR).
• Analytics or advertising cookies already on the first visit, before any choice (§ 165 para. 3 TKG 2021).
• No way back to the cookie settings: withdrawal harder than consent (Art. 7(3) GDPR).