Austria Recording Laws: All-Party Consent Rules and Penalties (2026)

Austria requires all-party consent for recording private conversations under StGB §120. A single covert recording is a criminal offense carrying up to one year in prison. This guide covers every major provision, from phone calls to workplace surveillance to deepfakes.

Information last verified on 2026-05-15. This article has not yet been reviewed by a licensed lawyer. Readers should consult a qualified Austrian attorney for advice on their specific situation.

Jurisdiction scope: This article addresses recording law in Austria under the Austrian Criminal Code (Strafgesetzbuch, StGB), the Data Protection Act (Datenschutzgesetz, DSG), the Telecommunications Act 2021 (TKG 2021), the Labour Constitution Act (Arbeitsverfassungsgesetz, ArbVG), and directly applicable EU law including the GDPR and the EU AI Act (Regulation 2024/1689). It does not address the recording laws of Germany or Switzerland; for those, see the relevant country spokes on this site.

Quick Answer: Is Austria an All-Party Consent State?

Austria is an all-party consent jurisdiction. Under §120(1) StGB, recording any private conversation without the consent of all participants is a criminal offense. The prohibition applies equally to participants in the conversation and to outside listeners. You cannot lawfully record your own phone call without informing the other party. You cannot secretly record a meeting even if you are present. The law targets the act of activating a recording device to capture statements not intended for device-based capture, not merely the act of listening. Violations carry up to one year in prison or a fine of up to 720 Tagessätze (daily rates). Publishing an unlawfully obtained recording is a separate offense under §120(2) StGB with the same maximum penalties. Austria's consent requirement is broader than the one-party consent rule that prevails in many other jurisdictions and significantly stricter than the federal baseline under US law.

StGB §120: The Core Criminal Prohibition

Section 120 of Austria's Criminal Code is titled "Missbrauch von Tonaufnahme- oder Abhörgeräten" (Misuse of Recording or Eavesdropping Devices). It contains four subsections that collectively make Austria an all-party consent jurisdiction.

§120(1): Recording Private Statements

The first subsection prohibits using any recording device or eavesdropping device to obtain knowledge of a non-public statement of another person that is not intended for the listener's knowledge. The penalty is imprisonment of up to one year or a fine of up to 720 daily rates (Tagessätze).

The two key legal elements are:

• "Nicht öffentlich" (not public): The statement must have been made in a private setting.
• "Nicht zu seiner Kenntnisnahme bestimmt" (not intended for the recorder's knowledge): The speaker did not intend for the person operating the device to hear the statement.

This means that even if you are a participant in a conversation, recording it without the other party's consent can violate §120(1) if the other person did not intend for their words to be captured by a device. The law targets the use of the device itself, not merely the act of listening.

§120(2): Sharing or Publishing Recordings

Subsection 2 carries the same penalty structure. It prohibits making a recording of someone's non-public statement accessible to a third party, or publishing such a recording, without the speaker's consent. Even if a recording was originally made lawfully, distributing it without permission is a separate criminal act.

§120(2a): Telecommunications Interception

This subsection specifically addresses telecommunications. Anyone who records a message transmitted via telecommunications that was not intended for them, with the intent to learn or share its contents, faces up to three months in prison or a fine of up to 180 daily rates. This provision applies when the conduct does not already fall under the stricter penalties of §120(1) or (2), or under §119 StGB.

The lower penalty reflects that telecommunications interception by someone outside the conversation is treated somewhat differently from face-to-face recording abuse. However, it remains a criminal offense.

§120(3): Prosecution Requires Victim Authorization

Prosecution under §120 is an "Ermächtigungsdelikt," meaning the victim must authorize prosecution. The state does not pursue these cases on its own initiative. The injured party must file a formal authorization (Ermächtigung) for the prosecutor to act.

This procedural requirement does not diminish the seriousness of the offense. It simply means the victim controls whether charges move forward.

StGB §119 and §119a: Telecommunications and Computer Secrecy

§119: Telecommunications Secrecy

Section 119 StGB protects the secrecy of telecommunications more broadly. It criminalizes the use of any device attached to a telecommunications system or computer system to intercept messages not intended for the interceptor. The penalty is up to six months in prison or a fine of up to 360 daily rates.

The provision covers electronic surveillance devices, software-based interception tools (such as trojans used to spy on email traffic), and any hardware modifications to telecommunications infrastructure. It protects the transmission path specifically. Stored messages, such as emails sitting in an inbox, fall under different legal provisions.

Like §120, prosecution under §119 requires the authorization of the injured party.

§119a: Computer Data Interception

Section 119a StGB extends beyond telecommunications to cover the interception of computer data specifically. The provision implements Article 3 of the Budapest Convention on Cybercrime and criminalizes the surveillance of non-public data transmissions to, from, or within computer systems, including the interception of electromagnetic emissions from computer equipment.

The key distinction from §119 is scope: §119 protects the telecommunications transmission path; §119a protects data flows within and between computer systems, including data that never traverses a traditional telecommunications network. Software-based keyloggers, packet sniffers on a local network, and tools that capture electromagnetic radiation from screens or keyboards can all fall within §119a. The intent requirement is the same: the interceptor must act with the purpose of obtaining knowledge for themselves or an unauthorized third party.

StGB §120a: Unauthorized Image Recording

Since January 1, 2021, Austria has also criminalized certain unauthorized image recordings under §120a StGB. This provision targets anyone who intentionally captures images of another person's intimate areas (genitals, buttocks, female breasts, or underwear covering those areas) without consent, where the person has taken steps to protect those areas from view or is in a private residence.

The penalty is up to six months in prison or a fine of up to 360 daily rates. If the offender makes the images accessible to others or publishes them, the penalties increase.

This statute was introduced to address "upskirting" and similar invasions of bodily privacy. It complements §120's protections for audio recording by extending criminal liability to specific categories of visual recording.

StGB §107c: Publication of Recordings and Non-Consensual Intimate Images (NCII)

Section 107c StGB, titled "Fortdauernde Belästigung im Wege einer Telekommunikation oder eines Computersystems" (continued harassment via telecommunications or computer systems), addresses what is commonly called cybermobbing. It became effective January 1, 2016 and is directly relevant to anyone who publishes recordings or intimate images without consent.

Under §107c, a person commits an offense if, via telecommunications or computer system, and in a manner suited to unreasonably impair a victim's conduct of life over an extended period, they either:

1. Damage a person's honor in a manner perceptible to a larger number of people, or
2. Make facts or photo images from a person's most intimate life sphere perceptible to a larger number of people without that person's consent.

The base penalty is imprisonment of up to one year or a fine of up to 720 Tagessätze.

Aggravated penalties apply in three circumstances:

• The victim attempted or committed suicide as a result: up to three years in prison.
• The offender committed the acts repeatedly over a period exceeding one year: up to three years in prison.
• The harmful content remained perceptible to the public for more than one year: up to three years in prison.

§107c and Non-Consensual Intimate Images

The "most intimate life sphere" language in §107c covers non-consensual intimate images, including recordings made without consent and sexual or intimate images shared without the subject's permission (commonly referred to as "revenge porn"). The provision requires that the content be perceptible to a "larger number of people," which means private one-to-one sharing may fall outside §107c's scope while still potentially being covered by §120 StGB or civil law.

A significant legislative gap exists regarding single-instance publication of non-consensual deepfake pornography. Austrian parliamentary materials (XXVII/A/2860, XXVII/A/372, and the November 2025 proposal XXVIII/A/576) have identified that the current §107c requirement for extended duration or large-audience perceptibility may not capture a single viral posting of AI-generated intimate images. Proposals to remove the "extended duration" element from §107c to close this gap have been under parliamentary consideration since 2024. As of May 2026, no amendment to §107c has been enacted to address this specific gap.

OGH Case Law on Covert Recording

Austria's Supreme Court (Oberster Gerichtshof, OGH) has addressed covert recording in several significant decisions that clarify the legal standard under §120 StGB.

OGH 6 Ob 82/18d (2018): Human Dignity and Secret Recording

In this decision, the OGH articulated the foundational harm principle underlying §120: it would mean a serious impairment of human dignity if a person had to fear that every turn of conversation and the sound of their voice would be recorded without their knowledge. The court noted that this fear is inseparably linked to feelings of constant suspicion and mistrust, and that the law is designed to protect not only informational privacy but the freedom of interpersonal communication itself.

OGH 6 Ob 236/19b (2020): Ibiza Recording Case

This decision arose from the covert video and audio recording of a private conversation in Ibiza. The OGH reached a split result. On the creation of the recording, the court held that no Article 10 ECHR interest outweighs the right not to be secretly filmed and recorded during a non-public conversation; the footage was obtained by deception and was initially intended for sale rather than public debate, so the recording itself was unlawful under §120 StGB. On publication, however, the court reached the opposite conclusion: media outlets that published the recordings were justified under Article 10 ECHR because the footage made an extraordinary contribution to a debate of genuine public interest, enabling citizens to assess the politician's fitness for high office in a way that transcripts alone could not. The court thus drew a clear line between the unlawful act of covert capture and the separately justified act of publication.

These decisions confirm that Austrian courts apply §120 strictly to the act of making a secret recording. The Ibiza case additionally establishes that the unlawfulness of the original recording does not automatically bar publication where a compelling public-interest justification exists.

Phone Call Recording Rules

Austria treats phone call recording as a matter of both criminal law and data protection law. Under the criminal framework:

• All parties must consent before any recording begins. The Telecommunications Act 2021 (TKG 2021) and the DSG reinforce this requirement.
• Consent must be explicit, informed, and given before the recording starts. Implied consent or silence does not qualify.
• A participant who secretly records their own phone conversation without telling the other party commits a criminal offense under §120 StGB.

Businesses that record phone calls for quality assurance, training, or compliance must obtain active consent from callers at the start of the call. A recorded message stating "this call may be recorded for quality purposes" is a starting point, but under Austrian law, the caller must have the genuine ability to decline and still receive service. Simply continuing the call after a one-sided announcement may not meet the consent threshold required by both the StGB and the GDPR.

Penalties for Illegal Phone Recording

A Tagessatz (daily rate) in Austria ranges from EUR 4 to EUR 5,000, calculated based on the offender's income, assets, and personal circumstances. For a middle-income earner, a fine of 720 Tagessätze could easily reach tens of thousands of euros.

In-Person Conversation Recording

The rules for recording face-to-face conversations mirror those for phone calls. Section 120(1) StGB does not distinguish between in-person and remote communications. If a statement is non-public and not intended for the recorder's knowledge, capturing it with a device is criminal.

Practical scenarios where in-person recording becomes legally risky:

• Business meetings: Recording a private meeting without disclosing the device and obtaining consent from all participants violates §120.
• Personal disputes: Recording an argument with a spouse, neighbor, or colleague without their knowledge is criminal, even if you are a party to the conversation.
• Medical appointments: Patient-doctor conversations are private by nature. Recording them requires explicit consent.
• Legal consultations: Attorney-client conversations carry additional privilege protections.

The fact that you are present in the conversation does not create an automatic right to record it. Austrian law treats the act of activating a recording device as the prohibited conduct.

Recording Police and Public Officials

Recording police officers and other public officials in Austria is a nuanced area where §120 StGB's "non-public" criterion does significant analytical work.

When a police officer or public official is performing a public duty in a public space, their actions and spoken statements in that capacity are generally not "non-public" within the meaning of §120(1). A police officer issuing commands at a public demonstration, conducting a visible traffic stop, or making a public arrest is acting in a role where the public character of the conduct is inherent to the function. Recording the visual action is generally permissible under UrhG §78 provided publication does not violate legitimate personal interests.

However, the following limitations apply:

• Audio recording of the officer's private statements (anything beyond official commands or statements made in an official capacity) may still engage §120 if those statements were not intended for broader audience capture.
• Recording inside non-public spaces (a police station interior, a holding room) reverts to ordinary §120 analysis.
• GDPR obligations apply to any recording that captures and processes personal data, including images of identified or identifiable officers.
• Obstruction laws (§§ 269, 270 StGB) remain in force; recording must not physically obstruct police action.

The Austrian Ministry of Interior has not issued a formal public guidance document on citizen recording of police. The legal framework as understood from §120 StGB and UrhG §78 permits recording of publicly conducted official acts but does not authorize secret recording of private statements made by officers even in public settings.

Watch out: Recording an internal investigation interview, a private police conversation, or statements made by officers in non-official contexts (e.g., off-duty remarks) without consent almost certainly violates §120 StGB regardless of where the recording occurs.

Recording in Public Spaces

Austrian law distinguishes between public and private settings, but "public" does not mean "anything goes."

Under §120 StGB, the prohibition applies to non-public statements. A conversation held in a public park but conducted at a volume intended only for the direct participants could still qualify as non-public. Context matters. A political speech delivered to a crowd is public. Two people whispering at a cafe table are having a private conversation, even though the location is public.

For photography and video in public spaces, Austria's Copyright Act (UrhG) §78 establishes the "Recht am eigenen Bild" (right to one's own image). You may photograph people in public, but publishing those images requires that the subject's legitimate interests are not violated. Photographs used in derogatory, misleading, or commercial contexts without permission can give rise to civil liability.

Austria's Supreme Court has ruled that under certain circumstances, even the act of taking photos of individuals can violate their general personality rights, regardless of whether the images are published.

GDPR and the Austrian Data Protection Act (DSG)

Recording someone creates personal data. A voice recording, video, or photograph that identifies or can identify a natural person falls squarely within the scope of the GDPR and Austria's supplementary Data Protection Act (DSG).

Lawful Basis for Recording

Under Article 6 of the GDPR, any processing of personal data requires a lawful basis. For recording, the most common bases are:

• Consent (Article 6(1)(a)): The data subject has given clear, informed, and voluntary consent.
• Legitimate interest (Article 6(1)(f)): The controller has a legitimate interest that is not overridden by the data subject's rights. This basis is narrow for recording and generally requires a balancing test.

For audio recording of conversations, consent is almost always the only viable lawful basis in Austria, given the parallel criminal law requirements.

CCTV and Video Surveillance Under DSG §§12-13

Sections 12 and 13 of the DSG regulate video surveillance (Bildverarbeitung) specifically. The rules permit CCTV cameras only under limited circumstances:

• On privately owned property, to protect persons or goods.
• Where previous rights violations or specific security threats have occurred.
• For private documentation purposes, provided identification of individuals is not intended.

Controllers operating CCTV must ensure that recorded data is secured against unauthorized access and alteration. Audio recording combined with video surveillance triggers additional scrutiny and typically requires a Data Protection Impact Assessment (DPIA).

DSB Enforcement

The Austrian Data Protection Authority (Datenschutzbehörde, or DSB) is the national supervisory authority. In 2024, the DSB completed 214 procedures, with 62 resulting in fines totaling approximately EUR 1.7 million. GDPR penalties in Austria can reach up to EUR 20 million or 4% of annual global turnover, whichever is higher.

The DSB has the power to investigate complaints, order the deletion of unlawfully processed data, and impose administrative fines. For recording violations, individuals may also pursue damages through civil courts under Article 82 of the GDPR.

EU AI Act and Deepfake Regulations in Austria

The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024. Its prohibitions and definitions began applying on 2 February 2025. Full application for high-risk AI systems follows on 2 August 2026. As an EU regulation, it applies directly in Austria without national transposition.

Prohibited Practices Relevant to Recording and Surveillance

The AI Act prohibits several practices with direct relevance to recording law:

• Real-time remote biometric identification in publicly accessible spaces by law enforcement is prohibited, except in narrowly defined circumstances: locating missing persons, preventing imminent threats to life, or identifying suspects of serious crimes. Each deployment requires prior judicial or independent administrative authorization.
• Biometric categorization using AI to infer sensitive characteristics (political opinion, religious belief, sexual orientation) from surveillance imagery is prohibited outright.
• Social scoring using AI systems to evaluate individuals' trustworthiness based on their behavior is prohibited.

Deepfake Disclosure Requirements

Under Article 50 of the AI Act, providers and deployers of AI systems that generate or manipulate image, audio, or video content must ensure outputs are labeled as AI-generated in a machine-readable format. Where deepfakes depicting real identifiable persons are disseminated publicly, a visible disclosure is also required, unless the content is clearly satirical, artistic, or fictional in a context that makes the AI nature evident.

This obligation applies alongside, not instead of, the criminal prohibitions in §107c StGB and §120a StGB. An AI-generated intimate image published without the subject's consent violates §107c StGB regardless of whether the AI Act disclosure obligation has been met.

Austria's National Deepfake Proposals

Austria's parliament has been active on deepfake regulation. Key parliamentary materials include:

• XXVII/A/372 (2020): Motion calling for criminal prosecution of deepfakes.
• XXVII/A/2860 (2024): Motion proposing identity theft and deepfakes as standalone criminal offenses, postponed from the Justice Committee in June 2024.
• XXVII/III/740: Government action plan on deepfakes.
• XXVIII/A/576 (November 2025): Most recent proposal, advocating for technical safeguards on AI providers and civil and criminal liability for providers who fail to prevent creation of abusive deepfakes despite awareness of the risk.

As of May 2026, no standalone deepfake criminal offense has been enacted in Austria. The existing framework of §107c StGB (cybermobbing), §120a StGB (unauthorized intimate images), and §207a StGB (child sexual abuse material, which already covers AI-generated content involving minors) provides partial coverage but leaves a recognized gap for single-instance adult deepfake abuse.

Workplace Recording and Surveillance

Austrian labor law adds a distinct regulatory layer for workplace recording. The Arbeitsverfassungsgesetz (ArbVG) governs employee monitoring, and its requirements are strict.

ArbVG §96(1)(3): Works Council Consent

Section 96(1)(3) ArbVG requires the works council's consent (through a formal Betriebsvereinbarung, or works agreement) before an employer may implement control measures and technical systems for monitoring employees that affect human dignity.

This covers:

• Video surveillance cameras in the workplace
• Audio recording of calls or conversations
• GPS tracking of field employees
• Software that monitors computer usage or keystrokes
• Automated performance tracking systems

The threshold is whether the monitoring measure affects human dignity (die Menschenwürde berührt). Austrian courts interpret this broadly. Permanent video surveillance of entrances, exits, and work areas almost always crosses this threshold.

What Happens Without Works Council Approval

If an employer implements monitoring without a valid works agreement, the system is unlawful. The employer must remove the monitoring equipment, and any data collected through it may be inadmissible. Employees and the works council can seek injunctive relief through labor courts.

Companies Without a Works Council

In workplaces where no works council exists, the employer must obtain individual consent from each affected employee before implementing monitoring measures that touch human dignity. This consent must meet GDPR standards: freely given, specific, informed, and unambiguous.

Absolute Prohibitions

Some forms of workplace surveillance are categorically prohibited, regardless of any agreement:

• Secret tapping of telephone conversations
• Surveillance cameras in washrooms, changing rooms, or rest areas
• Routine body searches
• Investigation of employees' private lives

These measures violate human dignity outright and cannot be authorized through any works agreement or individual consent.

Recordings as Evidence in Court

Austrian law takes an unusual position on illegally obtained recordings. Unlike some jurisdictions that exclude unlawfully gathered evidence entirely, Austrian courts generally allow illegally obtained evidence to be presented, including covert recordings that violated §120 StGB.

However, this does not mean recording someone without consent is consequence-free. The person who made the illegal recording still faces criminal prosecution under §120 StGB and potential civil liability under the GDPR and the Copyright Act (UrhG).

Austrian courts apply a two-part test when a party seeks to introduce a clandestine recording:

1. Evidentiary emergency (Beweisnotstand): There must be no other means available to prove the claim. The recording must be the only way to establish the relevant facts.
2. Balance of interests: The interests of the party presenting the recording must outweigh the privacy interests of the person who was recorded.

If both conditions are met, the court may admit the recording while separately addressing the criminal and civil liability of the party who created it.

Business Compliance Guide

Organizations operating in Austria must navigate the intersection of criminal law, data protection, and labor law. Here is a practical compliance framework.

Call Centers and Customer Service

• Obtain explicit, active consent from every caller before recording begins.
• Provide callers with a genuine option to decline recording and still receive service.
• Store recordings securely and establish retention limits.
• Conduct a DPIA if recording is systematic or large-scale.
• Document the lawful basis for processing under the GDPR.

Office and Facility Surveillance

• Negotiate a Betriebsvereinbarung with the works council before installing cameras or audio equipment.
• Post visible signage identifying surveillance areas.
• Never install cameras in private areas (restrooms, break rooms, changing areas).
• Limit audio recording to situations where it is strictly necessary and proportionate.
• Conduct a DPIA for any system that combines audio and video capture.

Remote Workers and Digital Monitoring

• Screen monitoring, keystroke logging, and activity tracking software all require works council agreement under ArbVG §96(1)(3).
• Inform employees in writing about what is monitored, how data is stored, and how long it is retained.
• Ensure monitoring is proportionate to the legitimate business interest.

Data Retention and Security

• Under DSG §13, recorded data must be secured to prevent unauthorized access or alteration.
• Establish and enforce data retention schedules. Austrian law does not permit indefinite storage of surveillance footage.
• Under the GDPR, data subjects have the right to access, rectify, and request deletion of their recorded data.

Penalties Summary

The consequences of illegal recording in Austria come from multiple legal sources.

Criminal Penalties (StGB)

Tagessätze range from EUR 4 to EUR 5,000 per day, depending on the offender's financial situation.

Administrative Penalties (GDPR/DSG)

• Fines up to EUR 20 million or 4% of annual global turnover.
• Orders to cease processing and delete data.
• Public reprimands published by the DSB.

Civil Liability

• Damages under GDPR Article 82 for material and non-material harm.
• Copyright Act (UrhG §78) claims for violations of the right to one's own image.
• Injunctive relief and compensation for personality rights violations.

Labor Law Consequences

• Court orders to remove unlawful monitoring systems.
• Potential invalidity of disciplinary actions based on unlawfully obtained surveillance data.

Cross-Border Recording: Austria, Germany, and Switzerland

Austria sits within a region where all three major legal systems impose all-party or near-all-party consent requirements for private recordings. Understanding how these regimes compare is important for anyone operating across borders.

Austria and Germany

Both countries require all-party consent for recording private conversations. Germany's §201 StGB is structurally similar to Austria's §120 but carries harsher maximum penalties (up to three years for the most serious violations versus one year in Austria). The Austrian procedural requirement that the victim authorize prosecution (Ermächtigungsdelikt under §120(3)) is a significant practical distinction: in Austria, a victim who chooses not to authorize prosecution effectively blocks the criminal case, whereas German law does not uniformly condition prosecution on victim consent.

For a call between an Austrian and a German participant, both countries' laws potentially apply. Each party is subject to the law of their own country, and a participant making the call from Austrian territory must comply with Austrian law regardless of where the other party is located.

Austria and the EU GDPR Cross-Border Framework

When a recording involves personal data processed across EU member states, GDPR's one-stop-shop mechanism applies. The supervisory authority of the controller's main establishment has lead jurisdiction. Austria's DSB cooperates with other EU data protection authorities through the European Data Protection Board (EDPB) consistency mechanism for cross-border cases.

International Calls from Austria

When recording a call with a person located outside the EU, Austrian criminal law (StGB §120) still applies to the Austrian participant's conduct. The foreign participant's home country law may also apply simultaneously. Jurisdiction is determined by where the conduct occurs, and activating a recording device on Austrian territory is conduct on Austrian territory regardless of where the other party is located.

Disclaimer

This article presents general legal information about recording laws in Austria. It is not legal advice and does not create an attorney-client relationship. The information covers Austrian law including StGB §§107c, 119, 119a, 120, and 120a, the Datenschutzgesetz (DSG), the Arbeitsverfassungsgesetz (ArbVG), and EU law including the GDPR and EU AI Act as in force as of May 2026. Laws change; always verify current statute versions via ris.bka.gv.at. Readers with questions about a specific situation should consult a lawyer licensed to practice in Austria.

Last updated: 2026-05-15. Statutes cited reflect their in-force version as of 2026-05-15.