Summary: In Austrian online advertising, the consent banner, actual data transmission and contracts need to agree. Server-side tracking can make forwarding easier to control. The legality of processing and the commercial performance of advertising each require their own assessment.
A banner can look correct while a marketing tag already sends data before the visitor chooses. A browser Pixel can also be properly blocked while an uncontrolled server integration continues forwarding events. Start with the actual path of a visit or purchase: what information is created, who receives it and what permits that transmission?
This guide covers practical technical checks for Austrian businesses. It does not replace a legal assessment of your particular processing; consult qualified counsel and the WKO data protection resources for disputed questions. Reviewed on 28 September 2026.
Which rules and organisations matter in Austria?
Put noyb complaints and earlier decisions in context
noyb complaints bring specific processing practices before regulators. Its 2025 annual report records 21 new complaints. That number is not an Austrian fines statistic or a ranking of European enforcement.
The 2020 Schrems II judgment invalidated the former Privacy Shield. The Austrian Google Analytics decision adopted in late 2021 and published in 2022 addressed a particular transfer under the circumstances assessed; the DSB’s 2022 report documents the case. Neither establishes a permanent ban on every use of analytics. Since July 2023, the EU–US Data Privacy Framework has covered eligible transfers to participating US businesses. The Austrian DSB explains its scope and limits.
The DSB and telecommunications authorities have different roles
The Data Protection Authority assesses processing of personal data under the GDPR. The telecommunications authorities enforce the relevant TKG requirements. A tracking flow can involve both. Calling Austria Europe’s strictest advertising jurisdiction does not establish whether a particular shop’s processing is permitted.
Section 165(3) TKG covers more than cookies
The rule concerns storing information on a device or accessing information there. Non-essential technologies generally require prior consent. An exception concerns transmission of a communication or functions strictly necessary for a service explicitly requested by the user. A shopping cart and an advertising Pixel therefore need separate assessment. The DSB cookie FAQ explains this framework.
Four common consent banner mistakes
- Preselected marketing purposes. A checked box does not replace an active choice. Separate necessary functions from optional processing.
- Access conditional on tracking consent. Cookie walls and “pay or okay” arrangements require assessment of genuine choice and available alternatives. A blanket approval or prohibition would overstate the rule.
- A hidden or harder rejection route. Visibility, clarity and effort matter. A particular button colour is not automatically unlawful, but an obscure refusal route can undermine free choice.
- Transmission before the choice. The banner must govern the relevant browser tags and server forwarding. Changing the visible banner alone is insufficient. Withdrawal must also affect the data path.
A CMP helps manage choices; installing it does not establish correct implementation. Test a new visit without a choice, rejection, acceptance and withdrawal. Inspect network requests and server forwarding. Your consent rate, broken down by device and source, is a diagnostic observation rather than a universal target.
Which risks and penalties should you understand?
There is no price list for banner defects. Depending on the infringement, GDPR ceilings are €10 million or 2%, or €20 million or 4%, of worldwide annual turnover, with the higher amount applying in the relevant category. Actual decisions depend on individual circumstances. The DSB outlines controller obligations and penalty ceilings.
| Risk | What to check |
|---|---|
| Unlawful tracking | Purpose, legal basis and actual transmission before a permitting choice. |
| Invalid consent | Information, genuine choice, rejection, evidence and withdrawal. |
| Unclear supplier roles | Controller, joint controller or processor; the appropriate arrangement. |
| Unlawful international transfer | Actual recipient and DPF coverage or another valid mechanism. |
| Insufficient evidence | Data flows, access, retention and verifiable implementation. |
TKG infringements need a separate assessment of the applicable rule and competent authority. These ceilings do not establish the usual fine for a specific implementation mistake.
Which data can advertising integrations receive?
Assess each field’s purpose, source, legal basis, recipient and format. Contact details collected to fulfil an order are not automatically available for advertising matching. Order fulfilment and advertising are different purposes, even when they use the same email address.
Permitted matching may use normalised, hashed contact information. Hashing does not automatically anonymise data. Fields also have different requirements: email and phone may require SHA-256, whereas value, currency, event_id, IP address, user agent and fbp/fbc use different formats. The Meta SDK user-data implementation distinguishes these parameters.
First name, last name, city and postcode are also relevant only when the particular matching function needs them and their processing is permitted. A longer parameter list is not a quality target; each recipient and purpose must remain traceable.
Keep health information, other special categories under Article 9 and unnecessary form contents out of advertising events. Page URLs and query parameters can disclose sensitive details too. A customer ID remains an identifier; sending it from a server does not turn it into an anonymous aggregate. Minimise fields to what the permitted purpose needs. Define Purchase, AddToCart and Lead clearly, and prevent product names from exposing sensitive details.
What server-side tracking makes easier to control
Four properties can be useful:
- Permission before forwarding: the server checks the decision relevant to the specific purpose.
- Parameter selection: the integration sends permitted fields from an identified source.
- A traceable route: an owned endpoint can simplify the route, although not every CAPI integration needs your own subdomain.
- Error diagnosis: minimal logs help check deliveries and retries, with access controls and deletion periods.
A server cannot undo a browser request that has already happened. EU hosting and an owned subdomain do not automatically prevent a later transfer to a US recipient. Technical documentation and the legal assessment must describe the same complete flow.
Erkado: results from a particular project
In the Erkado project in the Czech Republic, measurement and Meta campaigns were reworked together. The scope included CAPI, custom server-side code, event deduplication and advanced matching.
In our ongoing engagement with Czech online retailer Erkado, work combines server-side event tracking, segmented campaigns across three distinct goals (e-commerce sales, B2B leads, and showroom hiring), and mobile checkout UX adjustments guided by Clarity observations. This demonstrates that reliable tracking infrastructure establishes data clarity, but works in concert with campaign management rather than driving isolated revenue leaps alone.
These figures come from Canem Errant’s published case report. They are neither an independent compliance assessment nor the isolated effect of CAPI or consent. They do not establish an expected CPA reduction for another shop.
What Google Consent Mode v2 actually controls
For applicable measurement and advertising functions using EEA user data, Google requires the relevant choices to be collected and communicated. Its EEA traffic guidance defines the product scope. Describing this as one mandatory architecture for every conversion since March 2024 is too broad.
Four signals matter: ad_storage, analytics_storage, ad_user_data and ad_personalization. They govern different functions. Permission for storage does not automatically authorise personalised advertising.
With Basic Consent Mode, Google tags remain blocked until the relevant permission. With Advanced Consent Mode, cookieless signals can be sent while consent is denied. “Cookieless” does not mean “no data transmission”. Google describes both implementations and the effects of individual signals.
| Area | What still needs assessment |
|---|---|
| Remarketing | Personalisation requires the applicable permission; modelling does not authorise an individual audience of people who refused. |
| Conversion measurement | Separate observed and modelled values; modelling depends on eligibility and data. |
| Google features | Communicate the signals required by the product being used. |
| Measurement gaps | Compare your own figures with the shop or CRM; there is no universal recovery percentage. |
| Legal assessment | Inspect actual requests and purposes; Consent Mode is not a compliance certificate. |
A four-stage implementation checklist
1. Check the banner and actual behaviour
- Offer clear acceptance and rejection without making refusal harder.
- Remove preselected optional purposes.
- Assess access conditions and any alternatives for genuine choice.
- Separate necessary technologies from marketing technologies.
- Document choices and withdrawal in a verifiable way.
2. Document data flows and responsibilities
- Keep the required Article 30 record of processing activities current.
- Assess each recipient’s role and arrangements; Article 28 applies to processors.
- Check international transfers: the specific legal entity, active DPF participation and covered data, or a suitable alternative such as SCCs with necessary supplementary measures.
3. Configure the selected measurement architecture
- Assess whether a server-side GTM container is needed and how it will be operated.
- Gate CAPI forwarding on the server when CAPI is used.
- Configure Google Consent Mode v2 for the features in use.
- Deduplicate browser and server events.
- Use advanced matching only with permitted fields in their correct formats.
Depending on the systems, implementation can take weeks; this is not a guaranteed delivery schedule. Test value, currency, retries, rejection and withdrawal afterwards. See the tracking service and the guide to event deduplication.
4. Establish regular checks
- Review EMQ and transmission errors regularly and after changes.
- Observe your consent rates by device without chasing an unsupported market benchmark.
- Follow relevant DSB decisions and noyb proceedings.
Calculate benefit and complete costs separately
Illustrative calculation, not a forecast: €5,000 monthly media spend at €40 CPA corresponds to 125 orders. An independently confirmed reduction to €32, or 20%, would correspond mathematically to 156.25 orders. With an €80 order value, revenue changes from €10,000 to €12,500. Rounding down to 156 orders gives €12,480, an increase of €2,480.
All amounts are excluding VAT. With an assumed 40% contribution margin after variable costs and returns, the extra €2,500 initially produces €1,000. Assumed €100 hosting leaves €900 before implementation, maintenance, CMP and other costs. The €100 is not a Canem Errant price. Contribution is not company profit.
To calculate payback, you need actual setup costs and a confirmed additional contribution after recurring expenses. Simultaneous changes to campaigns, offers or creatives complicate attribution of the effect. A technical improvement can also reveal revenue that was previously measured incorrectly. More recorded conversions alone therefore do not establish additional sales.
Recommended start: systematically check choices, transmission and order discrepancies to define justified work. Shorter start: inspect one main purchase path and obvious transmissions after rejection; this takes less time but leaves other paths untested. More cautious start: restrict optional forwarding until technical and legal assessment; this reduces processing but requires more manual analysis. A small, simple setup does not necessarily need a server container.
Frequently Asked Questions
What privacy penalties can Austrian advertisers face?
Depending on the infringement, GDPR ceilings are €10 million/2% or €20 million/4% of worldwide annual turnover, with the higher amount applying in the relevant category. Penalties are determined individually. TKG infringements require separate assessment of the rule and competent authority; there is no general price list for banner defects.
What does the TKG 2021 mean for online advertising?
Section 165(3) concerns storage and access on devices. Non-essential technologies generally require prior consent, with an exception for strictly necessary functions of an explicitly requested service. The choice must control actual behaviour. A particular button colour alone does not determine legality.
Can businesses run Meta Ads and Google Ads while complying with the GDPR?
That depends on the specific purpose, data flow, user choices, recipients and arrangements. EU hosting or a CMP alone does not establish lawful processing. Inspect actual requests and obtain a separate assessment of disputed legal questions.
Which customer data can be sent for advertising matching?
Only fields that are permitted and necessary for the specific purpose, in the correct format. Email and phone may require normalisation and SHA-256; value, currency and technical parameters are treated differently. A hash used for matching does not automatically anonymise data or extend consent to other purposes.
Does server-side tracking improve privacy and CPA at the same time?
It can make permission checks, parameter selection and error diagnosis easier to control. Legal acceptability and commercial effects remain separate questions. Server forwarding must not bypass rejection, and the architecture does not establish a guaranteed CPA reduction.
Want to understand what your advertising integrations actually send? Discuss a technical review with Canem Errant. A brief initial conversation defines the question; diagnostic work and implementation are agreed separately.
