VPNs with servers in Austria

Section 167 of the Telecommunications Act 2021 bars storing or transmitting traffic data except where the Act expressly allows it; operators of public networks and services must store it where billing requires, then delete or anonymise it after payment and a three-month objection period, save in cases such as a dispute or an unpaid bill. It creates no duty to retain. Whether a VPN operator owes any interception duty is not established.

The messenger law, passed by the National Council in early July 2025, lets the state security service (DSN) read messages on services such as WhatsApp and Signal to prevent an attack punishable by ten years or more, or espionage. Sixty-seven members of the FPÖ and Green clubs asked the VfGH to annul it (G 13-14/2026); after a public hearing on 22 June 2026, the court had published no ruling as of 3 November 2026.

Blocking in Austria is ordered by courts. In UPC Telekabel Wien (C-314/12, 27 March 2014), on a reference from the Supreme Court, the EU Court held that an internet provider can be ordered to block customers’ access to a copyright-infringing site. The measures must not unnecessarily deprive users of lawful access to information and must have the effect of preventing unauthorised access to the protected material or at least making it difficult.

Section 283 of the Criminal Code (Verhetzung, incitement against groups) applies to statements made publicly in a way accessible to many people and carries up to two years’ imprisonment, up to three years where committed in print, broadcast or otherwise so that it reaches a broad public, and six months to five years where it leads to violence.

Section 3g of the Prohibition Act (Verbotsgesetz) punishes National Socialist activity (Wiederbetätigung) with six months to five years, and one to ten years where it becomes accessible to many people.

The VfGH has limited state surveillance before. On 11 December 2019 it struck down parts of the 2018 security package, among them the covert monitoring of encrypted messages by installing a programme on a computer system, calling it a serious interference with Article 8 ECHR that is permissible only within very narrow limits.

As presented in April 2025, the messenger scheme required the DSN to put each request to the Legal Protection Officer, who has three days to respond, and to the Federal Administrative Court, which decides; a first authorisation lasts up to three months. A five-member independent control commission for the DSN was confirmed by the National Council in July 2023 by a two-thirds majority, after a search of more than a year.

The order of the rows is the security score, and a server’s location is not a recommendation.