> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Austria TKG 2021 + RTR/DSB Sender Rules
> The Austria SMS rules expanded from the country-requirements matrix: the TKG 2021 §107 marketing opt-in, the RTR alphanumeric sender-ID convention and its letter-of-authority paperwork, the DSB's DSG 2018 data-protection posture, the German-language STOP family, the E-Commerce-Gesetz suppression expectation, and RTR time-window guidance — mapped to the Orbit surfaces you already own.
# Austria TKG 2021 + RTR/DSB Sender Rules
Austria (`AT`) is the high-volume DACH market whose rules split across
two regulators instead of one. The telecom side sits with the RTR
(Rundfunk und Telekom Regulierungs-GmbH), the office that serves the
Telekom-Control-Kommission (TKK), which applies the
Telekommunikationsgesetz 2021 (TKG 2021) — including the §107 opt-in
regime for electronic marketing communications. The data-protection
side sits with the Datenschutzbehörde (DSB), which enforces the
Datenschutzgesetz (DSG 2018) alongside the GDPR. Over both, the
E-Commerce-Gesetz (ECG) sets the commercial-communications baseline
that makes a working suppression practice part of the posture. This
page expands the AT row of the
[country-requirements matrix](/compliance/country-requirements) so you
can close the Austrian items deliberately instead of re-reading one
JSON blob per launch.
Austria is a **tenant-owned burden**. Orbit never mandates your
posture — it keeps the
[country-rules reference](/compliance/country-requirements) that feeds
the send-time gates, and it gives you the consent ledger,
sender-registration, quiet-hours, and opt-out surfaces below. The
legal posture is yours.
This page is documentation, not legal advice. The DSB enforces the
DSG 2018 and the GDPR against the sender, with administrative fines
up to the GDPR ceilings, and the RTR's sender convention is policed
at the carrier edge. Have counsel review your consent capture and
sender paperwork; Orbit supplies the surfaces.
***
## The Austria-specific rules
Read the AT row of `GET /api/v1/compliance/country-rules?channel=sms`
(see
[Country Compliance Requirements](/compliance/country-requirements)).
The live row is the send-time truth; this page documents the posture
behind it.
```bash theme={null}
curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms®ion=EU" \
-H "Authorization: Bearer $ORBIT_API_KEY"
```
Read `sender_types`, `registration`, `content_restrictions`, and
`stop_requirement` from the AT row before every launch. A registry
refresh can raise a row's `registration` level (never lower it), so
the row you read today is the one the gate enforces tomorrow.
Consolidated:
| Rule | AT value | What it means for you |
| - | - | - |
| Sender types | `alphanumeric`, `long_code` | Both accepted. Alphanumeric sender IDs into +43 travel under the RTR convention: a sender the letter-of-authority paperwork can identify filters less than one that cannot. |
| Registration | live row decides; no platform hard gate | The send-time gate holds AT only as far as the live `registration` level says, and Orbit defaults stay open. The RTR convention still argues for filing the sender before launch — treat the paperwork as a launch item, not a gate. File through [Sender-ID Registration](/compliance/sender-id-registration). |
| Marketing consent | Prior opt-in required (TKG 2021 §107 + GDPR) | §107 gates electronic marketing communications behind prior consent; the DSB applies the same reading to the processing behind the send. Consent must exist before dispatch — record it in the consent ledger with `sms` scope. |
| Opt-out keyword | German vocabulary mandatory | Every AT marketing message must accept the German opt-out family; the seeded alias table maps `STOPP`, `ABBESTELLEN`, `ABMELDEN`, `ENDE` (the same aliases as the DE row, plus case/Unicode-normalised variants) to your suppression ledger. See [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table). |
| Suppression | ECG expectation | The E-Commerce-Gesetz expects a recipient who objects to receive nothing further. Keep the objection in the tenant-owned suppression ledger, scoped to `all`, and scrub every AT audience against it. See [Opt-Out Suppression](/compliance/opt-out-suppression). |
| Send window | No statutory window; RTR guidance | Austria has no statutory no-send window; the RTR guidance and the DACH complaint pattern mirror the German 21:00–09:00 convention. Honour it with tenant quiet hours over Europe/Vienna — off by default. |
***
## The two regulators — RTR for telecom, DSB for data protection
**RTR / TKK (telecom).** The RTR is the regulatory office; the TKK is
the commission that decides telecom matters on top of it, and the TKG
2021 is the statute both apply. For A2P SMS the provisions that touch
you are the §107 opt-in regime for electronic marketing
communications and the sender identification convention the RTR
maintains for traffic into Austrian networks. When a sender dispute
or a registration question has a telecom flavour, it lands here.
**DSB (data protection).** The DSB is Austria's data-protection
authority, and the DSG 2018 is the national statute it enforces
alongside the GDPR. The consent record behind every AT marketing send
has to survive DSB examination: a lawful basis, a timestamp, and a
source the recipient would recognise. When a complaint arrives, it is
the DSB that reads your ledger.
The split is why Austria needs two ledgers kept straight: the sender
paperwork answers to the RTR side, the consent and suppression
evidence answers to the DSB side.
***
## The RTR alphanumeric sender-ID convention
Austrian carriers expect an alphanumeric sender ID into +43 to
resolve to an originator the RTR-side paperwork can identify. There is
no statutory register that holds your traffic at the gate; the
convention works the way other European markets' conventions work —
a registered, authorised sender delivers, an unvetted one is the
class carriers relabel or drop. The filtering you hit without the
paperwork is deliverability, not an Orbit gate.
The paperwork that carries the convention is the letter of
authority: the brand named on the sender ID authorises the entity
that originates the traffic, and the filing names both. The
tenant-owned control that carries it in Orbit is the
[Sender-ID Registration](/compliance/sender-id-registration)
submit-and-track flow — file the AT sender there with the letter of
authority attached, and treat the approval state as a launch blocker
for AT marketing traffic even while the live row's `registration`
level stays open. Orbit records the filing and the approval; the
authority itself sits with you and your provider.
***
## TKG 2021 §107 — marketing opt-in and the consent record
TKG 2021 §107 is Austria's opt-in regime for electronic marketing
communications: consent before the send, never after. The DSB reads
silence, bundled consent, and pre-ticked boxes the same way German
courts read them under UWG — they do not establish consent. For
AT-bound marketing SMS the statute stack runs:
* **GDPR + DSG 2018** — lawful basis and provable consent for the
processing behind the send. Record it the way the
[GDPR Posture Guide](/compliance/gdpr-posture-guide) describes.
* **TKG 2021 §107** — Austria's own telecom-layer addition: marketing
by electronic communications is lawful only with the recipient's
prior consent.
* **Withdrawal symmetry** — an opt-out must be as easy as the opt-in
and must stop the traffic. A German opt-out reply fires the alias
rule and writes a suppression entry scoped to `all`, so `STOPP`
knocks the recipient off SMS, WhatsApp, and RCS in one event.
The consent record has to *exist* before the first marketing send and
be *provable* on complaint. Give every record the fields the DSB will
ask for:
* the timestamp the recipient opted in (the consent-granted-at
value),
* the channel scope (`sms` for AT marketing SMS),
* the source text the recipient saw at capture,
* the proof pointer you export when counsel asks.
Record it in [Consent Management](/compliance/consent-management)
before the first dispatch, and export it with timestamps from
[Archival Export](/compliance/archival-export) when the DSB or
counsel asks.
***
## The German-language STOP family
Austria shares its opt-out vocabulary with Germany. The seeded alias
table already maps the DE family — `STOPP`, `ABBESTELLEN`,
`ABMELDEN`, `ENDE`, plus case- and Unicode-normalised variants — to
the suppression ledger, and the same aliases cover AT traffic; no
separate Austrian seeding is needed. Confirm the aliases are live on
your tenant and that each match writes the suppression entry scoped
to `all`, exactly like the English `STOP` family. See
[Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table)
for the seeded set and the scope each alias writes, and the
[Germany page](/compliance/germany-uwg-bnetza) for the DE posture the
aliases come from.
***
## The E-Commerce-Gesetz suppression ledger
The ECG's commercial-communications regime expects that once a
recipient objects, no further commercial message reaches them — on
any channel the objection covers. The tenant-owned surface that
carries this in Orbit is the suppression ledger described in
[Opt-Out Suppression](/compliance/opt-out-suppression): one
tenant-owned ledger, entries scoped per channel or to `all`, written
by the alias rule on a German STOP reply and by your imports for
opt-outs captured off-platform (a support email, a paper form, an
unsubscribe click). Scrub every AT audience against the ledger before
each launch, and keep the entries exportable — when the DSB asks how
an objecting recipient still received traffic, the ledger is the
answer.
***
## RTR time-window guidance
Austria has no statutory no-send window like France's 20:00–08:00
convention. What Austria has is the RTR guidance and a DACH complaint
pattern that mirror the German 21:00–09:00 convention: marketing
traffic that lands in the evening or the early morning produces the
complaints the DSB prices. The tenant-owned control is the same
deliberate opt-in as every other strict market:
| Surface | Behaviour for AT |
| - | - |
| Tenant quiet hours (deliberate) | [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — opt-in tenant control, default **OFF / fail-open**; configure a Europe/Vienna recipient-local window mirroring Germany's 21:00–09:00 if you want the platform to hold AT marketing sends. Nothing in Orbit defaults this on. |
| Consent-default policy | Set the org-level consent-default policy so AT marketing traffic requires a consent record, not a consent assumption — see [Consent Default Policy](/compliance/consent-default-policy). |
| Suppression scrub | Scrub every AT audience against the [suppression ledger](/compliance/opt-out-suppression) before each launch; the ECG expectation is that an objector receives nothing further. |
Where AT differs from FR: France's window is a market convention
surfaced in the country-rules `content_restrictions`; Austria's is
guidance plus a complaint pattern. Both end at the same
configuration — you set tenant quiet hours deliberately — but
nothing AT-specific appears in the rules row to remind you, so this
page does.
***
## Where each AT obligation maps in Orbit
| AT obligation | Orbit surface |
| - | - |
| Consent before marketing send (TKG 2021 §107 + GDPR/DSG 2018) | [Consent Management](/compliance/consent-management) — a consent record with `sms` scope before dispatch; posture in the [GDPR Posture Guide](/compliance/gdpr-posture-guide) |
| RTR sender convention + letter of authority | [Sender-ID Registration](/compliance/sender-id-registration) submit-and-track flow; the [send-time gate](/compliance/send-gates) holds only as far as the live `registration` level says, so treat the paperwork as a launch blocker |
| German opt-out vocabulary | [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) — `STOPP`, `ABBESTELLEN`, `ABMELDEN`, `ENDE` map to the suppression ledger, scoped to `all` |
| ECG suppression expectation | [Opt-Out Suppression](/compliance/opt-out-suppression) — the tenant-owned ledger, scrubbed before every AT launch |
| Provable consent on DSB complaint | [Archival Export](/compliance/archival-export) — export the ledger with the consent-granted-at timestamp |
| Send-window discipline | [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — deliberate tenant opt-in over Europe/Vienna recipient time |
***
## AT launch checklist
Narrowed from the generic launch checklist in
[Country Compliance Requirements](/compliance/country-requirements)
to the AT row:
Call `GET /api/v1/compliance/country-rules?channel=sms®ion=EU`
and read the AT row's `sender_types`, `registration`,
`content_restrictions`, and `stop_requirement`.
Submit the AT sender ID with the letter of authority through
[Sender-ID Registration](/compliance/sender-id-registration);
under the RTR convention carriers filter unvetted alphanumeric
traffic.
Record a consent entry with `sms` scope — timestamp, source
text, proof pointer — before any AT marketing send; TKG 2021
§107 is opt-in, not opt-out. See
[Consent Management](/compliance/consent-management) and the
[GDPR Posture Guide](/compliance/gdpr-posture-guide).
Confirm `STOPP`, `ABBESTELLEN`, `ABMELDEN`, `ENDE` are mapped in
the alias table and write the suppression entry scoped to `all`.
See
[Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table).
Scrub the AT audience against the
[suppression ledger](/compliance/opt-out-suppression) before each
launch; import off-platform objections as you collect them.
If you run AT marketing traffic, turn on tenant quiet hours over
Europe/Vienna recipient time, mirroring the German 21:00–09:00
convention — Orbit defaults this off. See
[Quiet-Hours Configuration](/guides/quiet-hours-configuration).
With AT enabled on the tenant, the sender filed, consent
captured, keywords wired, the ledger scrubbed, and quiet hours
set, start sending.
***
## Related references
* [Country Compliance Requirements](/compliance/country-requirements) —
the full matrix this page expands one row of.
* [Regional Posture Hub](/compliance/country-rules-directory) — the
index of every per-country page, including this one.
* [GDPR Posture Guide](/compliance/gdpr-posture-guide) — the EU-side
consent posture behind Austria's opt-in rule set.
* [Germany UWG + BNetzA](/compliance/germany-uwg-bnetza) — the DACH
sibling whose STOP aliases and window convention Austria shares.
* [Sender-ID Registration](/compliance/sender-id-registration) — the
submit-and-track flow for the AT sender and its letter of
authority.
* [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) —
the German `STOPP` family and its scope.
* [Opt-Out Suppression](/compliance/opt-out-suppression) — the
tenant-owned suppression ledger the ECG expectation lands in.
* [Consent Management](/compliance/consent-management) — where the AT
marketing opt-in record lives.
* [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — the
tenant-owned opt-in control you use to set the AT send window.
* [Send Gates](/compliance/send-gates) — the gates that enforce the AT
`registration` level at send time.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.