Two years ago you had your website built. The Impressum and privacy policy came out of a generator, the cookie banner went in quickly, and that was that. It was perfectly reasonable at the time. Nobody expects a carpenter or a tax adviser to read amendments to the data-protection act on the side. Plenty has moved in your business since then, while the site still shows the position it had back then. That is the ordinary way a legal page goes quietly out of date.
One thing up front, in plain terms: this piece gets you oriented and sorts out the main points. The specifics for your own situation are best confirmed with your legal adviser or directly with the WKO.
What does an Austrian business website legally need?
Three obligations apply to almost every commercial website in Austria: a complete Impressum with Offenlegung details, a privacy policy, and cookie consent that is given actively, before any non-essential cookie loads. A fourth applies to every business that falls within the scope of the Barrierefreiheitsgesetz, the conformity information. Here is the short version, then we go through each one.
| Requirement | Legal basis | What minimally satisfies it |
|---|---|---|
| Impressum and Offenlegung | § 5 ECG, § 25 Mediengesetz | Name or company name, address, email plus one more contact method, Firmenbuch number and UID if you have them, chamber membership and a pointer to the trade or professional rules that apply |
| Privacy policy | Art. 13 GDPR | Who processes data, for what purpose, on what legal basis, who receives it, for how long, and what rights visitors have |
| Cookie consent | § 165 para. 3 TKG 2021, GDPR | Active opt-in before non-essential cookies are set, with no pre-ticked boxes |
| Conformity information | § 14 (2) BaFG | A description of the service in an accessible form and of how it meets the requirements, owed only inside the law’s scope |
The Impressum: what belongs on every Austrian business website
An Impressum carries your name or company name, a deliverable address, contact details including an email address, your Firmenbuch number and Firmenbuch court and your UID where they exist, and a pointer to the trade or professional rules that apply to you. Which company details come on top of that depends on whether you are entered in the Firmenbuch. The Offenlegung under the Mediengesetz is added to it. Both statutes ask the same thing of placement: the details have to be continuously easy and immediately available.
The E-Commerce-Gesetz (§ 5 ECG) lists the items that belong on every commercial site:
- name or company name
- a geographic address where you are established
- contact details that allow rapid, direct communication, with the email address named explicitly
- Firmenbuch number and Firmenbuch court, if you are registered
- the responsible supervisory authority, so far as your activity is actually under official supervision
- the chamber or professional body you belong to, which for an Austrian business means your Wirtschaftskammer membership, plus any professional title and the state that conferred it
- a pointer to the trade or professional rules that apply to you, and a way to read them
- your UID number, if you have one
- whether stated prices include VAT and other charges, and what delivery costs
Two lines in that list get read too narrowly. The chamber membership and the pointer to the rules apply to every trade. The statute writes them for “a Diensteanbieter subject to gewerbe- oder berufsrechtlichen Vorschriften”, meaning trade law as well as professional law, and trade law applies to a carpenter exactly as professional law applies to a tax adviser. That item is also what the best-known Austrian decision on § 5 ECG turned on: in 4 Ob 211/13b the OGH upheld an injunction against a travel agency on one ground only, the missing pointer to the applicable trade and professional rules together with a way to reach them. The business won every other point that had been raised against it. In practice, naming the Gewerbeordnung and linking to ris.bka.gv.at does the job.
The supervisory authority works the other way round. You owe it only so far as your activity is genuinely subject to official supervision, which is how § 5 (1) no. 5 ECG is written. The WKO recommends naming the responsible Gewerbebehörde in every case, and that recommendation goes beyond the statutory text. The distinction is worth keeping, because it tells you which line in your Impressum discharges a duty and which one is a precaution.
What that list leaves out is the question most owners ask first: does a one-person business owe the same as a GmbH? Not quite. The ECG items are the same for every site. Beyond them it depends on your legal form, and the extra duty is added to the ECG items. It sits in the Unternehmensgesetzbuch, which names the website expressly: anyone entered in the Firmenbuch has to give the § 14 (1) UGB details “on all business letters and order forms … as well as on their websites”.
| What you are | What else belongs on the website | Basis |
|---|---|---|
| GmbH or other registered company | Firma, legal form, seat, Firmenbuch number and Firmenbuch court, plus a note of a liquidation where one is running | § 14 (1) UGB |
| Sole trader not entered in the Firmenbuch | name and the location of the trade authorisation | § 63 (1) GewO 1994 |
| Sole trader entered in the Firmenbuch | the same items as a registered company, plus your own name where it differs from the Firma | § 14 (1) UGB |
If you run a GmbH, two fields deserve a closer look. Against the ECG list, § 14 (1) UGB brings exactly two new items, the legal form and the seat. The Firmenbuch number and the Firmenbuch court are required by both statutes, the ECG and the UGB. They sit in the list of duties twice over, which makes them the two details a GmbH can least afford to leave out. The legal form is usually visible in the company name itself, so the WKO treats a separate entry for it as not strictly necessary.
Just as useful is what a GmbH does not owe on an ordinary company site:
- The managing director. § 14 (1) UGB does not list them, and the small Offenlegung under § 25 (5) Mediengesetz leaves the authorised representatives out as well. The WKO recommends the entry to businesses selling into Germany, because German law requires it on small sites too. For an Austrian site it is a precaution.
- The share capital. § 14 (2) UGB asks for the Stammkapital and any outstanding cash contributions only if your site says something about the company’s capital in the first place. A site that stays silent on capital owes nothing here.
- A supervisory authority, as long as nothing supervises your activity.
The Offenlegung under § 25 Mediengesetz sits on top. For an ordinary company site that presents the business itself and carries no opinion-forming content, the small version is enough: name or company name, the business purpose where there is one, and place of residence or registered seat. The business purpose is easy to miss. The Mediengesetz expressly allows these details to be published together with the ECG items, so a second page is not needed.
Where does the Impressum have to sit, and does the link have to say “Impressum”?
Austria prescribes no link label, no click count, and no rule that the details appear on every subpage. Both statutes set a standard and leave the implementation to you. § 5 (1) ECG requires you to make the information available “continuously … easily and immediately accessible” (“ständig … leicht und unmittelbar zugänglich”). § 25 (1) Mediengesetz puts it this way for websites: “Auf einer Website sind diese Angaben ständig leicht und unmittelbar auffindbar zur Verfügung zu stellen”, continuously easy and immediately findable.
The OGH has confirmed this expressly. In 4 Ob 211/13b of 17 December 2013 it held that it does no harm if the required details “are not gathered in a specially highlighted field called ‘Impressum’, as long as they are otherwise continuously, easily and immediately accessible within the web presence, which is to be examined on the circumstances of the individual case”. In that case the company name sat in the top right of the homepage.
What that means in practice:
- A footer link that appears on every page and says “Impressum” meets the standard safely and is the conventional route in Austria.
- The word “ständig”, continuously, carries weight. Details that disappear for a while, because a subpage drops out in a relaunch for instance, do not discharge the duty in that period.
- “Easily and immediately” is judged case by case. A visitor should be able to identify you and get in touch without hunting.
- The two-click rule comes from German case law and does not bind in Austria.
Several companies on one website: who owes what?
The duty attaches to the legal entity, meaning the business itself. One website can carry several of them, and then each one owes the complete list for itself. A shared block that names only one of the businesses does not cover the others.
That follows from the wording of the statutes. § 3 no. 2 ECG defines the Diensteanbieter as a “natural or legal person or other legally capable body providing an information society service”. § 5 (1) ECG then speaks throughout of a single provider: “its name or company name”, “the geographic address at which it is established”. No provision anywhere in the ECG lets one business’s block of details stand in for another’s.
| Duty | Who owes it on a shared website |
|---|---|
| § 5 (1) ECG | every legal entity offering its own service through the site, each with the complete list |
| § 14 (1) UGB | every company entered in the Firmenbuch, separately |
| § 63 (1) GewO 1994 | every unregistered sole trader, separately |
| Offenlegung under § 25 Mediengesetz | the Medieninhaber, meaning whoever shapes the content and provides or causes its availability. The WKO states expressly that there can be more than one. |
For one case the legislator wrote the answer down itself. § 14 (1) sentence 2 UGB covers a Personengesellschaft, an unincorporated commercial firm, in which no natural person carries unlimited liability, the classic GmbH & Co KG. The details then have to be given on that company’s business letters, order forms and websites “auch über die unbeschränkt haftenden Gesellschafter”, meaning for the members with unlimited liability as well. Two legal entities, one website, two complete blocks of details.
For the general case of two businesses sharing a site, no Austrian authority has published guidance and no court has ruled on it. The complete list per legal entity is therefore the reading that stays with the wording of the statutes. In practice that means one Impressum page, a clearly separated block per business, every block complete, and where the content divides up, a sentence saying which business is responsible for which part. No statute prescribes a particular layout here.
The obvious shortcut does not hold up: putting the GmbH’s details on the page and treating the owner’s sole trader business as covered by them. The same applies the other way round.
What happens if the Impressum is missing?
Three statutes, three separate penalties, and they bite in different places:
| Duty breached | What the statute threatens |
|---|---|
| the § 5 (1) ECG details | an administrative fine of up to € 3.000 (§ 26 (1) no. 1 ECG) |
| the § 14 UGB details | a Zwangsstrafe, a coercive fine, imposed by the Firmenbuch court, and in a company directed at the members of the authorised body personally (§ 14 (5) UGB, § 24 FBG) |
| the duty to publish an Impressum and the details named in § 25 (2) and (3) Mediengesetz | a fine of up to € 20.000 imposed by the Bezirksverwaltungsbehörde, the district administrative authority (§ 27 (1) no. 1 Mediengesetz) |
The third row is the one most guides leave out. § 27 (1) no. 1 Mediengesetz names the duty to publish an Impressum and the details in § 25 (2) and (3). An ordinary company site owes the small Offenlegung under § 25 (5), and whether the penalty reaches that has not been decided. What deserves more attention than the fines anyway is that a missing or incomplete Impressum is also open to challenge under competition law in Austria, more on that below.
How you notice your Impressum has fallen behind. The law tends to sit still here while your business moves:
- You changed legal form or entered the Firmenbuch. Company name, legal form, Firmenbuch number and Firmenbuch court all change with it.
- You moved offices. The address and the location of the trade authorisation move too, and often the responsible authority.
- A second legal entity now appears on the same site, a newly founded GmbH alongside the existing sole trader business for instance. That brings a complete second block of details with it.
- The email address you listed is no longer read. An inbox nobody checks stops serving the purpose the entry has.
A change of managing director does not belong on that list. As long as your Impressum does not name the managing director of its own accord, the change leaves it untouched.
The privacy policy: the moment you process data, you need one
The moment you collect data directly from visitors, the information duty under Art. 13 GDPR applies. That happens earlier than most owners assume: a contact form collects names and email addresses, server logs capture IP addresses, and both are personal data. The policy belongs in the footer as its own page, separate from the Impressum.
Art. 13 sets out what has to be in it:
- who is responsible for the processing, with contact details, and the contact details of the data protection officer where that role exists
- the purpose of each processing activity and the legal basis for it, purpose by purpose
- where you rely on legitimate interests, what that interest actually is
- who receives the data, meaning the services you genuinely run
- whether data goes to a third country, whether an adequacy decision covers it, and how to obtain a copy of the safeguards
- how long you store it, or the criteria you use to decide
- the rights to access, rectification, erasure, restriction, objection and data portability, and where you rely on consent, the right to withdraw it
- the right to lodge a complaint with the Datenschutzbehörde
- whether providing the data is a statutory or contractual requirement, and what happens if someone does not provide it
- whether automated decision-making including profiling takes place, with meaningful information about the logic involved
Where you receive data about someone from a third party rather than from the person, Art. 14 applies with almost the same list. It adds the categories of data concerned and the source they came from.
Three items go missing on small sites over and over, and all three come from the template:
- The recipients appear as a category (“service providers”) where the actual tools belong: your hosting, your form backend, your email provider by name.
- The retention period reads “as long as necessary” where a concrete period per purpose belongs.
- One legal basis covers the whole page where each purpose needs its own.
One item moves without you touching anything, which is why it slips past. The legal basis on which a US provider may receive data from the EU has already changed since 2022 and is under challenge again. If your policy names a particular basis, that is the line that goes out of date while your site stays exactly as it is.
How you notice your privacy policy has fallen behind:
- A new tool arrived, a booking widget, a chat, a newsletter platform.
- You switched hosting or form provider. The recipient in the list is no longer the one receiving the data.
- You keep enquiries for a shorter or longer period than you used to.
- The legal basis shifted, for instance because a mailing list now runs on consent rather than legitimate interest.
- A service that used to stay inside the EU started sending data to a third country.
Cookie consent: consent first, cookie second
Non-essential cookies may only load after the person has actively consented. That follows from § 165 para. 3 TKG 2021 together with the GDPR. Without consent the statute allows two cases only: transmitting the message across the network, and whatever is strictly necessary to provide a service the user explicitly asked for.
Valid consent meets four conditions:
- It is an active step. In the Planet49 ruling (1 October 2019) the EuGH made clear that pre-ticked boxes are not valid consent, and simply carrying on browsing is in the same category.
- It comes before the cookie. A banner with the analytics script already running underneath it does not do the job.
- Refusing may not be more work than accepting. A banner where accepting is one click and refusing runs through a settings menu is the pattern regulators are currently pushing back on.
- It rests on clear information about what is being consented to.
Technically necessary cookies are exempt, such as session management for a shopping cart or storing the cookie choice itself. You need consent for analytics cookies, advertising pixels, embedded social media, and the like. One detail that makes life easier for a lot of owners: if you measure traffic without cookies, you never trigger the consent duty in the first place. No cookie, no banner.
Two questions get mixed together on US tools. The first is whether the provider may receive the data out of the EU at all. The second is whether you needed consent before its cookie loaded. Each has its own answer, and settling the first gains you nothing on the second. Analytics software with the transfer question cleanly resolved still needs consent before its cookie is set.
How you notice your cookie consent has fallen behind:
- A new tool on the site sets a cookie that appears in none of your banner’s categories.
- The banner was redesigned and the path to refusing got longer than the path to accepting.
- A service you run changed where it sends data.
The accessibility document: who owes one, and what goes in it
If your website falls within the scope of the Barrierefreiheitsgesetz, a fourth document comes with it, the conformity information under § 14 (2) BaFG. It describes your service in an accessible form, explains what a reader needs in order to follow how you actually deliver it, and sets out the way it meets the applicable requirements. It also has to state which parts of your web presence do not meet those requirements, or meet them only partly, with a concrete reason for each. Microenterprises that fall outside the scope of the BaFG do not owe the document at all. Whether the law reaches you, what matters when the site is built, and where the size thresholds sit are covered in our post Does My Small Business Website Need to Be Accessible?.
How you notice it has fallen behind: the document describes a state, and the state moves with your site. A redesign, a new booking or shop module, or an embedded video shifts which parts are accessible and which are not. And a business that grows past the microenterprise threshold owes the document for the first time.
What actually happens in Austria when something is missing
So this does not tip into scaremongering, the sober view of enforcement helps. Anyone who wants to complain turns to the Datenschutzbehörde (DSB). The complaint procedure is free and runs as a two-party process in which you, as the operator, have to respond. The DSB can find a violation and order changes. It does not impose a fine within the complaint procedure itself, that requires a separate administrative penalty process.
Austria differs clearly from Germany here. In Germany, competitors can issue cease-and-desist letters over GDPR breaches under competition law, which has grown into a whole industry. In Austria, the OGH ruled in 2019 that, as things currently stand, competitors cannot pursue GDPR breaches through a UWG cease-and-desist (4 Ob 84/19k). So there is no blanket wave of competitor letters over data-protection issues. The Impressum is a different matter: a missing or incomplete Impressum under the ECG can indeed be pursued under competition law. The bottom line is that the obligations are the same as in Germany. The way they reach you is different, usually through a complaint from one individual rather than a wave of litigation.
What this looks like away from the authorities was on display in the Google Fonts affair. A wave of demand letters went around Austria in 2022, with roughly 33,000 businesses receiving a payment claim by post because their sites pulled fonts from a Google server. The courts have since shut that business model down. On 29 March 2024 the Bezirksgericht Favoriten dismissed one such claim as an abuse of rights. The Landesgericht Wien then confirmed that decision on appeal. The matter is not final, and a further step to the OGH was announced.
What counts for you is the principle underneath it. A font pulled from someone else’s server sends your visitor’s IP address there, and an IP address is personal data. Serve your fonts, maps and scripts yourself and the question never arises.
Why a site that was finished once slowly drifts out of compliance
These four documents fall behind for much the same reason every time. What dates them are events in your business that have nothing to do with the law at the moment you decide them. You order a booking tool, you move into a bigger office, you switch hosting provider. Every one of those decisions is made for a good reason, and none of them feels like a job for the website.
| What changes at your end | What has to follow on the website |
|---|---|
| Firmenbuch registration or a new legal form | Impressum: company name, legal form, Firmenbuch number, Firmenbuch court |
| An office move | Impressum: address, location of the trade authorisation, possibly the authority |
| A second legal entity on the same site | Impressum: a complete second block of details |
| A new tool on the site (booking, chat, newsletter) | Privacy policy and cookie banner |
| A switch of hosting or form provider | Privacy policy: the recipients |
| A different retention period for enquiries | Privacy policy: the storage period |
| A redesign, a new shop, a new booking module | Conformity information, and often the cookie banner |
| A provider changes where it sends data | Privacy policy: third-country transfer |
That is the whole mechanism. The four documents hang on facts that change in the business anyway, and they only hear about it when somebody notices. The cheapest moment to bring them along is the day of the change itself, while someone still knows exactly what changed.
If you would rather not carry that alongside the day job: with us, changes to the website are part of the monthly price, Impressum, privacy policy and cookie banner included. What else it covers is set out in the FAQ.
If you are just getting a site built, the legal layer is part of what a good provider thinks through. The five pages every business website needs answers the question of which pages sell, while this piece answers which pages the law requires. And what else comes after launch shows why a website is an ongoing service rather than a one-time project.