The court upheld an earlier decision by the Austrian Data Protection Authority that found DerStandard's implementation failed to provide users with legitimate choice options for specific data processing purposes. According to privacy organization noyb, which filed the complaint, the case will likely proceed to Austria's Supreme Administrative Court and potentially the European Court of Justice.

DerStandard operates as Austria's leading liberal newspaper and pioneered the "Pay or Okay" approach when GDPR regulations took effect. Rather than offering genuine choice between accepting and rejecting tracking by hundreds of third parties, the platform required users to either consent or purchase a monthly subscription currently priced at €9.90.

Extreme consent rates demonstrate systematic manipulation

The court's decision highlights troubling statistics regarding user behavior under "Pay or Okay" systems. Only 1-7% of users genuinely want tracking for online advertising when asked directly. However, "Pay or Okay" mechanisms achieve 99.9% user agreement to online tracking.

"We won't rescue online journalism with a couple of cents per month and users through Google Ads," stated Max Schrems from noyb. "At the same time 'pay or okay' undermines a core pillar of the GDPR - freely given consent. Instead of a genuine choice of users, we get a North-Korean consent rate of 99.9% with this system."

The substantial disparity between user preferences and actual consent behavior formed the central legal challenge. When over 90% of users fail to receive their preferred outcome, courts determined this represents manipulation rather than legitimate choice.

Technical deficiencies compound legal violations

The Austrian Data Protection Authority determined that DerStandard's specific approach violated consent requirements. The system only permitted global consent or rejection when legal frameworks require options to consent for specific processing types. DerStandard argued that granular consent proved incompatible with "Pay or Okay" systems since tracking and statistics were necessary for advertisement sales in non-paid versions.

The court criticized this reasoning as fundamentally flawed. Publishers earn € 0.24 per user and month from tracking according to academic research, while choosing the Pay option costs users €3.24 per user and month. This dramatic pricing disparity demonstrates the exploitative nature of these mechanisms.

European regulatory momentum builds against manipulative practices

The decision reflects growing enforcement action across European jurisdictions. French data protection authority CNIL has taken enforcement action against multiple website publishers for using deceptive design practices in their cookie consent banners, issuing formal notices requiring compliance within one month.

The Belgian Data Protection Authority this week issued a decision against media company Mediahuis, ordering significant changes to the cookie consent mechanisms on four of its news websites. The authority imposed potential fines of €25,000 per day per website for non-compliance, demonstrating serious regulatory commitment to enforcement.

German authorities face ongoing litigation over delayed responses to Pay or Okay complaints. Privacy advocacy group noyb announced it has filed a lawsuit against the Hamburg Data Protection Authority (DPA) in the Hamburg Administrative Court challenging approval of DER SPIEGEL's Pay or Okay system.

Economic arguments prove insufficient justification

The court rejected DerStandard's economic necessity arguments. Digital advertising accounts for approximately 10% of European press revenue, with targeted advertising representing only 5% of newspaper and magazine income according to industry analysis. The minimal financial impact contradicts publisher claims that personalized advertising represents essential revenue streams.

German users face €1,528.87 annually for rejecting consent across 29 top-100 websites implementing pay-or-okay models. This substantial consumer burden relative to actual advertising value demonstrates disproportionate pricing structures designed to coerce consent rather than provide legitimate alternatives.

Technical limitations further undermine the economic rationale. Browser implementations like Safari and Firefox block third-party cookies by default, while ad-blocking software reaches significant adoption rates. Only 30% of internet users remain trackable through current advertising technology, limiting revenue potential regardless of consent rates.

Legal precedent establishes strict requirements

The Austrian Federal Administrative Court's ruling establishes detailed criteria for evaluating consent mechanisms under both telecommunications and data protection regulations. Effective consent requires three core elements: informed decision-making, voluntary agreement, and unambiguous expression.

The decision particularly emphasized that consent must not be "more time-consuming" than giving consent. Pay or Okay banners clearly fail this standard by requiring extensive registration processes, payment information, and ongoing subscription management for users refusing tracking.

Individual compensation claims are emerging through civil courts as enforcement mechanisms supplement regulatory oversight. Private litigation represents an additional avenue for addressing consent violations beyond administrative proceedings.

Industry implications signal fundamental changes

The ruling carries significant implications for digital marketing operations across European territories. Publishers relying on advertising revenue through real-time bidding systems face increased pressure to balance monetization requirements with consent compliance obligations.

Marketing technology vendors providing consent management platforms must demonstrate that their solutions prevent manipulative design patterns while maintaining operational effectiveness. Platform providers cannot rely on economic arguments to justify consent mechanisms that fail to meet legal standards.

The decision establishes that supervisory authorities cannot accept consent systems achieving extreme compliance rates that contradict user preferences. Authorities must evaluate consent validity based on whether users receive their genuinely preferred outcomes rather than technical compliance with procedural requirements.

Timeline and legal pathway forward

The case will proceed through Austria's judicial hierarchy with potential European Court of Justice referral. DerStandard has been permitted to appeal to the Supreme Administrative Court given the novel legal questions involved.

The timing coincides with similar regulatory actions across multiple jurisdictions, suggesting emerging consensus on acceptable consent interface standards. These coordinated efforts demonstrate systematic opposition to manipulative consent practices rather than isolated national concerns.

Timeline

• August 2024: Privacy advocate sues Hamburg DPA over 'Pay or OK' consent banner decision
• September 2024: Belgian DPA imposes strict measures on Mediahuis for cookie consent violations
• December 2024: French data protection authority orders websites to fix misleading cookie banners
• July 2024: Decoding Cookie Consent: a look at noyb's report
• May 2025: German court clarifies cookie banner compliance requirements
• August 2025: European websites achieve "North Korean consent rates" through payment barriers

PPC Land explains

Pay or Okay Model

The "Pay or Okay" system represents a consent mechanism where users must either agree to data tracking or pay for a subscription to access content without tracking. This approach has become controversial because it creates financial pressure that undermines genuine consent, with studies showing 99.9% of users agree to tracking when faced with payment alternatives, despite only 1-7% genuinely wanting personalized advertising.

GDPR Consent Requirements

The General Data Protection Regulation establishes that valid consent must be freely given, specific, informed, and unambiguous. Under GDPR Article 7, consent cannot be considered free when there is a clear imbalance of power or when refusing consent results in detriment to the user. The Austrian court ruling reinforces that economic coercion through subscription fees violates these fundamental consent principles.

Data Protection Authority

Data Protection Authorities serve as independent regulatory bodies responsible for enforcing privacy laws within their jurisdictions. The Austrian Data Protection Authority's initial ruling against DerStandard demonstrates how these agencies evaluate consent mechanisms, focusing on whether users receive genuine choice rather than merely technical compliance with procedural requirements.

Consent Rates Analysis

Traditional cookie banners achieve 65-85% acceptance rates when users have genuine choice options. Pay or Okay systems consistently generate 99-99.9% consent rates, creating what privacy advocates describe as "North Korean consent rates." This dramatic disparity between user preferences and actual behavior serves as primary evidence that these systems constitute manipulation rather than legitimate choice.

European Court of Justice Pathway

The case's potential progression to the European Court of Justice represents significant legal precedent for consent interpretation across all EU member states. ECJ rulings become binding law throughout the European Union, meaning this Austrian case could establish continent-wide standards for consent validity and economic coercion in digital advertising.

Digital Advertising Revenue

Publishers typically earn €0.24 per user per month from tracking-enabled advertising, while Pay or Okay subscriptions cost users €3.24 per user per month on average. This 1,350% markup demonstrates that these systems prioritize subscription revenue over providing fair alternatives to tracking, revealing the exploitative economics underlying Pay or Okay models.

Consent Management Platforms

These technical systems help websites collect and manage user consent for data processing activities. Following recent court rulings, consent management platform providers must ensure their solutions prevent manipulative design patterns while maintaining operational effectiveness, requiring fundamental redesigns of many existing consent interfaces.

Cookie Banner Compliance

Cookie banners must provide equal prominence to accept and reject options, avoid dark patterns that guide users toward acceptance, and enable granular consent for specific processing purposes. Recent enforcement actions across France, Belgium, and Germany establish strict technical requirements that most current implementations fail to meet.

Privacy Advocacy Organizations

Groups like noyb (None of Your Business) play crucial roles in challenging unlawful consent practices through strategic litigation across European jurisdictions. These organizations provide legal expertise and resources that individual users lack, creating systematic pressure for compliance through coordinated complaint campaigns and court proceedings.

Regulatory Enforcement Trends

European data protection authorities are demonstrating increased coordination in addressing consent violations, with simultaneous actions in multiple countries suggesting systematic opposition to manipulative practices. This enforcement pattern indicates regulatory consensus that economic coercion undermines consent validity, signaling fundamental changes in acceptable digital advertising practices.

Summary

Who: The Austrian Federal Administrative Court ruled against DerStandard.at, Austria's leading liberal newspaper, in a case brought by privacy organization noyb (None of Your Business) challenging the legality of "Pay or Okay" consent mechanisms.

What: The court confirmed that DerStandard's "Pay or Okay" system violates European data protection laws by failing to provide users with genuine choice for specific data processing purposes, achieving manipulative 99.9% consent rates despite only 1-7% of users genuinely wanting tracking.

When: The Austrian Federal Administrative Court issued its decision on August 18, 2025, upholding an earlier ruling by the Austrian Data Protection Authority and permitting appeal to the Supreme Administrative Court.

Where: The case involves DerStandard.at's operations in Austria but has broader implications across European Union jurisdictions implementing similar "Pay or Okay" systems, with coordinated enforcement actions occurring in France, Belgium, and Germany.

Why: The ruling addresses fundamental questions about consent validity under GDPR when users face economic coercion, with the court determining that consent mechanisms achieving extreme compliance rates through payment barriers constitute manipulation rather than legitimate choice, setting precedent for privacy rights protection across digital advertising.