Austrian OGH: No Personalised Advertising Without Consent

Feb 5, 2026 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) has ruled on the conditions under which the processing of Facebook users’ personal data for personalised advertising and third-party tracking is permissible, as set out in Article 15 of the General Data Protection Regulation (GDPR).

In the case at hand, an Austrian Facebook user had sued the platform’s Irish operator, challenging the validity of their consent, seeking to stop certain data processing, requesting full GDPR Article 15 information, and claiming non-material damages. The defendant argued data processing was contractually necessary.

The OGH determined that processing personal data for personalized advertising, as well as aggregating and analyzing such data for advertising purposes, does not constitute a necessity for performing a contract under Article 6(1)(b) of the GDPR. Instead, this processing primarily supports the platform’s business model to the advantage of its advertising clients. Furthermore, the defendant could not justify this processing on the basis of legitimate interests, as the fundamental rights of users take precedence. Consequently, the defendant was ordered to discontinue these data processing activities.

The OGH has determined that processing data obtained from visits to or use of third-party websites—such as via social plug-ins, cookies, or similar methods—is not permitted without explicit consent. If such data processing involves special categories of personal data, clear, voluntary, informed, and specific opt-in consent is required. However, technical processing conducted solely for the purpose of displaying website elements is exempt from this requirement.

No declaration of invalidity of consent

The OGH rejected the plaintiff’s argument that his acceptance of the terms of use did not amount to valid consent under the GDPR. The determination of consent validity pertains solely to the legal attributes of juridical acts, rather than to legal relationships definable within the scope of Section 228 of the Austrian Code of Civil Procedure (ZPO, Zivilprozessordnung).

The OGH confirmed that the right to information under Article 15 GDPR is broad and all-encompassing. A defendant cannot simply give a user selected or so-called ‘relevant’ data, nor can they direct users to online tools for more details. Instead, they are required to supply full, clear, and well-structured details about all personal data processed—this includes information about the purposes of processing, the recipients of the data, and, when it comes from third parties, the exact source of the data.

The court granted the plaintiff EUR 500 in non-material compensation due to breaches of GDPR regulations.

OGH 6 Ob 189/24y, 26 November 2025