Austria Recording Laws: All-Party Consent Rules and Penalties (2026)

Overview of Recording Laws in Austria

Austria enforces some of the strictest recording laws in Europe. The country's Criminal Code (Strafgesetzbuch, or StGB) makes it a prosecutable offense to record private conversations without the consent of all participants. This is not a gray area or a civil liability issue. It is a crime.

The central statute is §120 StGB, which criminalizes the misuse of recording and eavesdropping devices (Missbrauch von Tonaufnahme- oder Abhörgeräten). Companion provisions in §119 StGB protect telecommunications secrecy, while §120a StGB addresses unauthorized image recording. On top of the criminal code, the EU General Data Protection Regulation (GDPR) and Austria's own Data Protection Act (Datenschutzgesetz, or DSG) add layers of regulatory exposure for anyone who captures, stores, or processes recorded material.

For businesses, the Arbeitsverfassungsgesetz (ArbVG) creates additional hurdles. Workplace monitoring that touches human dignity requires a formal agreement with the works council, and getting that wrong can invalidate the entire surveillance system.

This guide breaks down each of these legal frameworks, explains what they mean in practice, and covers the specific rules for phone calls, in-person conversations, public spaces, and business operations.

StGB §120: The Core Criminal Prohibition

Section 120 of Austria's Criminal Code is titled "Missbrauch von Tonaufnahme- oder Abhörgeräten" (Misuse of Recording or Eavesdropping Devices). It contains four subsections that collectively make Austria an all-party consent jurisdiction.

§120(1): Recording Private Statements

The first subsection prohibits using any recording device or eavesdropping device to obtain knowledge of a non-public statement of another person that is not intended for the listener's knowledge. The penalty is imprisonment of up to one year or a fine of up to 720 daily rates (Tagessätze).

The two key legal elements are:

• "Nicht öffentlich" (not public): The statement must have been made in a private setting.
• "Nicht zu seiner Kenntnisnahme bestimmt" (not intended for the recorder's knowledge): The speaker did not intend for the person operating the device to hear the statement.

This means that even if you are a participant in a conversation, recording it without the other party's consent can violate §120(1) if the other person did not intend for their words to be captured by a device. The law targets the use of the device itself, not merely the act of listening.

§120(2): Sharing or Publishing Recordings

Subsection 2 carries the same penalty structure. It prohibits making a recording of someone's non-public statement accessible to a third party, or publishing such a recording, without the speaker's consent. Even if a recording was originally made lawfully, distributing it without permission is a separate criminal act.

§120(2a): Telecommunications Interception

This subsection specifically addresses telecommunications. Anyone who records a message transmitted via telecommunications that was not intended for them, with the intent to learn or share its contents, faces up to three months in prison or a fine of up to 180 daily rates. This provision applies when the conduct does not already fall under the stricter penalties of §120(1) or (2), or under §119 StGB.

The lower penalty reflects that telecommunications interception by someone outside the conversation is treated somewhat differently from face-to-face recording abuse. However, it remains a criminal offense.

§120(3): Prosecution Requires Victim Authorization

Prosecution under §120 is an "Ermächtigungsdelikt," meaning the victim must authorize prosecution. The state does not pursue these cases on its own initiative. The injured party must file a formal authorization (Ermächtigung) for the prosecutor to act.

This procedural requirement does not diminish the seriousness of the offense. It simply means the victim controls whether charges move forward.

StGB §119: Telecommunications Secrecy

Section 119 StGB protects the secrecy of telecommunications more broadly. It criminalizes the use of any device attached to a telecommunications system or computer system to intercept messages not intended for the interceptor. The penalty is up to six months in prison or a fine of up to 360 daily rates.

The provision covers electronic surveillance devices, software-based interception tools (such as trojans used to spy on email traffic), and any hardware modifications to telecommunications infrastructure. It protects the transmission path specifically. Stored messages, such as emails sitting in an inbox, fall under different legal provisions.

Like §120, prosecution under §119 requires the authorization of the injured party.

StGB §120a: Unauthorized Image Recording

Since January 1, 2021, Austria has also criminalized certain unauthorized image recordings under §120a StGB. This provision targets anyone who intentionally captures images of another person's intimate areas (genitals, buttocks, female breasts, or underwear covering those areas) without consent, where the person has taken steps to protect those areas from view or is in a private residence.

The penalty is up to six months in prison or a fine of up to 360 daily rates. If the offender makes the images accessible to others or publishes them, the penalties increase.

This statute was introduced to address "upskirting" and similar invasions of bodily privacy. It complements §120's protections for audio recording by extending criminal liability to specific categories of visual recording.

Phone Call Recording Rules

Austria treats phone call recording as a matter of both criminal law and data protection law. Under the criminal framework:

• All parties must consent before any recording begins. The Telecommunications Act 2021 (TKG 2021) and the DSG reinforce this requirement.
• Consent must be explicit, informed, and given before the recording starts. Implied consent or silence does not qualify.
• A participant who secretly records their own phone conversation without telling the other party commits a criminal offense under §120 StGB.

Businesses that record phone calls for quality assurance, training, or compliance must obtain active consent from callers at the start of the call. A recorded message stating "this call may be recorded for quality purposes" is a starting point, but under Austrian law, the caller must have the genuine ability to decline and still receive service. Simply continuing the call after a one-sided announcement may not meet the consent threshold required by both the StGB and the GDPR.

Penalties for Illegal Phone Recording

Offense	Statute	Maximum Prison	Maximum Fine
Recording a private phone call without consent	§120(1) StGB	1 year	720 Tagessätze
Sharing a private phone recording without consent	§120(2) StGB	1 year	720 Tagessätze
Intercepting a telecom message not meant for you	§120(2a) StGB	3 months	180 Tagessätze
Tapping into telecom infrastructure	§119 StGB	6 months	360 Tagessätze

A Tagessatz (daily rate) in Austria ranges from EUR 4 to EUR 5,000, calculated based on the offender's income, assets, and personal circumstances. For a middle-income earner, a fine of 720 Tagessätze could easily reach tens of thousands of euros.

In-Person Conversation Recording

The rules for recording face-to-face conversations mirror those for phone calls. Section 120(1) StGB does not distinguish between in-person and remote communications. If a statement is non-public and not intended for the recorder's knowledge, capturing it with a device is criminal.

Practical scenarios where in-person recording becomes legally risky:

• Business meetings: Recording a private meeting without disclosing the device and obtaining consent from all participants violates §120.
• Personal disputes: Recording an argument with a spouse, neighbor, or colleague without their knowledge is criminal, even if you are a party to the conversation.
• Medical appointments: Patient-doctor conversations are private by nature. Recording them requires explicit consent.
• Legal consultations: Attorney-client conversations carry additional privilege protections.

The fact that you are present in the conversation does not create an automatic right to record it. Austrian law treats the act of activating a recording device as the prohibited conduct.

Recording in Public Spaces

Austrian law distinguishes between public and private settings, but "public" does not mean "anything goes."

Under §120 StGB, the prohibition applies to non-public statements. A conversation held in a public park but conducted at a volume intended only for the direct participants could still qualify as non-public. Context matters. A political speech delivered to a crowd is public. Two people whispering at a cafe table are having a private conversation, even though the location is public.

For photography and video in public spaces, Austria's Copyright Act (UrhG) §78 establishes the "Recht am eigenen Bild" (right to one's own image). You may photograph people in public, but publishing those images requires that the subject's legitimate interests are not violated. Photographs used in derogatory, misleading, or commercial contexts without permission can give rise to civil liability.

Austria's Supreme Court has ruled that under certain circumstances, even the act of taking photos of individuals can violate their general personality rights, regardless of whether the images are published.

GDPR and the Austrian Data Protection Act (DSG)

Recording someone creates personal data. A voice recording, video, or photograph that identifies or can identify a natural person falls squarely within the scope of the GDPR and Austria's supplementary Data Protection Act (DSG).

Lawful Basis for Recording

Under Article 6 of the GDPR, any processing of personal data requires a lawful basis. For recording, the most common bases are:

• Consent (Article 6(1)(a)): The data subject has given clear, informed, and voluntary consent.
• Legitimate interest (Article 6(1)(f)): The controller has a legitimate interest that is not overridden by the data subject's rights. This basis is narrow for recording and generally requires a balancing test.

For audio recording of conversations, consent is almost always the only viable lawful basis in Austria, given the parallel criminal law requirements.

CCTV and Video Surveillance Under DSG §§12-13

Sections 12 and 13 of the DSG regulate video surveillance (Bildverarbeitung) specifically. The rules permit CCTV cameras only under limited circumstances:

• On privately owned property, to protect persons or goods.
• Where previous rights violations or specific security threats have occurred.
• For private documentation purposes, provided identification of individuals is not intended.

Controllers operating CCTV must ensure that recorded data is secured against unauthorized access and alteration. Audio recording combined with video surveillance triggers additional scrutiny and typically requires a Data Protection Impact Assessment (DPIA).

DSB Enforcement

The Austrian Data Protection Authority (Datenschutzbehörde, or DSB) is the national supervisory authority. In 2024, the DSB completed 214 procedures, with 62 resulting in fines totaling approximately EUR 1.7 million. GDPR penalties in Austria can reach up to EUR 20 million or 4% of annual global turnover, whichever is higher.

The DSB has the power to investigate complaints, order the deletion of unlawfully processed data, and impose administrative fines. For recording violations, individuals may also pursue damages through civil courts under Article 82 of the GDPR.

Workplace Recording and Surveillance

Austrian labor law adds a distinct regulatory layer for workplace recording. The Arbeitsverfassungsgesetz (ArbVG) governs employee monitoring, and its requirements are strict.

ArbVG §96(1)(3): Works Council Consent

Section 96(1)(3) ArbVG requires the works council's consent (through a formal Betriebsvereinbarung, or works agreement) before an employer may implement control measures and technical systems for monitoring employees that affect human dignity.

This covers:

• Video surveillance cameras in the workplace
• Audio recording of calls or conversations
• GPS tracking of field employees
• Software that monitors computer usage or keystrokes
• Automated performance tracking systems

The threshold is whether the monitoring measure affects human dignity (die Menschenwürde berührt). Austrian courts interpret this broadly. Permanent video surveillance of entrances, exits, and work areas almost always crosses this threshold.

What Happens Without Works Council Approval

If an employer implements monitoring without a valid works agreement, the system is unlawful. The employer must remove the monitoring equipment, and any data collected through it may be inadmissible. Employees and the works council can seek injunctive relief through labor courts.

Companies Without a Works Council

In workplaces where no works council exists, the employer must obtain individual consent from each affected employee before implementing monitoring measures that touch human dignity. This consent must meet GDPR standards: freely given, specific, informed, and unambiguous.

Absolute Prohibitions

Some forms of workplace surveillance are categorically prohibited, regardless of any agreement:

• Secret tapping of telephone conversations
• Surveillance cameras in washrooms, changing rooms, or rest areas
• Routine body searches
• Investigation of employees' private lives

These measures violate human dignity outright and cannot be authorized through any works agreement or individual consent.

Recordings as Evidence in Court

Austrian law takes an unusual position on illegally obtained recordings. Unlike some jurisdictions that exclude unlawfully gathered evidence entirely, Austrian courts generally allow illegally obtained evidence to be presented, including covert recordings that violated §120 StGB.

However, this does not mean recording someone without consent is consequence-free. The person who made the illegal recording still faces criminal prosecution under §120 StGB and potential civil liability under the GDPR and the Copyright Act (UrhG).

Austrian courts apply a two-part test when a party seeks to introduce a clandestine recording:

1. Evidentiary emergency (Beweisnotstand): There must be no other means available to prove the claim. The recording must be the only way to establish the relevant facts.
2. Balance of interests: The interests of the party presenting the recording must outweigh the privacy interests of the person who was recorded.

If both conditions are met, the court may admit the recording while separately addressing the criminal and civil liability of the party who created it.

Business Compliance Guide

Organizations operating in Austria must navigate the intersection of criminal law, data protection, and labor law. Here is a practical compliance framework.

Call Centers and Customer Service

• Obtain explicit, active consent from every caller before recording begins.
• Provide callers with a genuine option to decline recording and still receive service.
• Store recordings securely and establish retention limits.
• Conduct a DPIA if recording is systematic or large-scale.
• Document the lawful basis for processing under the GDPR.

Office and Facility Surveillance

• Negotiate a Betriebsvereinbarung with the works council before installing cameras or audio equipment.
• Post visible signage identifying surveillance areas.
• Never install cameras in private areas (restrooms, break rooms, changing areas).
• Limit audio recording to situations where it is strictly necessary and proportionate.
• Conduct a DPIA for any system that combines audio and video capture.

Remote Workers and Digital Monitoring

• Screen monitoring, keystroke logging, and activity tracking software all require works council agreement under ArbVG §96(1)(3).
• Inform employees in writing about what is monitored, how data is stored, and how long it is retained.
• Ensure monitoring is proportionate to the legitimate business interest.

Data Retention and Security

• Under DSG §13, recorded data must be secured to prevent unauthorized access or alteration.
• Establish and enforce data retention schedules. Austrian law does not permit indefinite storage of surveillance footage.
• Under the GDPR, data subjects have the right to access, rectify, and request deletion of their recorded data.

Penalties Summary

The consequences of illegal recording in Austria come from multiple legal sources.

Criminal Penalties (StGB)

Offense	Maximum Prison	Maximum Fine
§120(1): Recording a private statement	1 year	720 Tagessätze
§120(2): Sharing/publishing a recording	1 year	720 Tagessätze
§120(2a): Recording telecom messages	3 months	180 Tagessätze
§119: Violating telecom secrecy	6 months	360 Tagessätze
§120a: Unauthorized intimate images	6 months	360 Tagessätze

Tagessätze range from EUR 4 to EUR 5,000 per day, depending on the offender's financial situation.

Administrative Penalties (GDPR/DSG)

• Fines up to EUR 20 million or 4% of annual global turnover.
• Orders to cease processing and delete data.
• Public reprimands published by the DSB.

Civil Liability

• Damages under GDPR Article 82 for material and non-material harm.
• Copyright Act (UrhG §78) claims for violations of the right to one's own image.
• Injunctive relief and compensation for personality rights violations.

Labor Law Consequences

• Court orders to remove unlawful monitoring systems.
• Potential invalidity of disciplinary actions based on unlawfully obtained surveillance data.