DSB (Austria) - 2025-0.276.820

A media company in Austria (the controller), which was publishing local news, operated a website which collected personal data from visitors using cookies and a cookie consent banner. Cookies included unique identifiers for tracking visitors. A media company in Austria (the controller), which was publishing local news, operated a website which collected personal data from visitors using cookies and a cookie consent banner. Cookies included unique identifiers for tracking visitors. In August 2021, a data subject filed a complaint with the Austrian Data Protection Authority (DSB), alleging violations of GDPR rights, including the right to erasure and the right to confidentiality of personal data. After investigation, the DSB dismissed the complaint but ex officio issued an order requiring the controller to modify its cookie banner. Specifically, the banner had to allow users to refuse consent on the first level as easily and visibly as they could accept it. The DSB set a ten-week deadlin