Skip to content
Last reviewed: 2026-05-05 Reviewer: M.K., CIPP/E Methodology Report inaccuracy
Editorial emblem — CHStylized flag-color motif for editorial reference. Not an official symbol.CH
Switzerland Schweizerische Eidgenossenschaft / Confédération suisse

WEB ANALYTICS · COOKIE COMPLIANCE · WESTERN EUROPE · CH

Switzerland — analytics & cookie compliance reference

What you can run on a Swiss-targeted website without trouble — nFADP since 1 Sep 2023, opt-out baseline (vs EU opt-in), criminal fines on natural persons up to CHF 250k, Swiss-US DPF since 15 Sep 2023.

nFADP Free reference · sources cited
// SCOPE

Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Switzerland. Switzerland's nFADP is non-EU but harmonized with GDPR; the opt-out baseline plus individual criminal liability define the local twist.

Applicable laws

The legal framework that governs personal data processing here.

NATIONAL · 2023-09-01
nFADP
Swiss Federal Act on Data Protection (revised, 2023)
1 jurisdictions · max —

National addons

Country-specific statutes layered on the EU baseline.

nFADP
Bundesgesetz über den Datenschutz (FADP, SR 235.1)
Federal data-protection statute applying to processing of personal data of natural persons by private controllers and federal bodies. Harmonized with GDPR (transparency, breach notification, ROPA, DPIA, profiling) but retains distinctly Swiss features: opt-out baseline for many processing activities, criminal liability on natural persons (not undertakings), and a recommendation-based regulator.
  • Art 10 Data Protection Advisor — recommended for private controllers, mandatory only for federal bodies (no headcount threshold equivalent to BDSG § 38)
  • Art 14 Representative — non-Swiss controllers regularly processing Swiss data of significant scale must designate a Swiss representative
  • Art 19-21 Information duties + automated decision-making — transparency and a right to human review
  • Art 22 Data Protection Impact Assessment — required for high-risk processing
  • Art 24 Breach notification — to FDPIC as soon as possible (no 72-hour hard deadline as in GDPR)
  • Art 26-27 Employee data — processing limited to suitability for the position or performance of the contract; read alongside Code of Obligations Art 328b
  • Art 60-66 Criminal provisions — intentional breaches of information, access, security, or duty of care punishable by fines up to CHF 250,000 imposed on the responsible natural person
Revised FADP (revFADP / nFADP / nLPD), entered into force 1 September 2023; replaces the 1992 FADP.
FMG
Telekommunikationsgesetz (Loi sur les télécommunications)
Electronic-communications privacy. Art 45c regulates cookies and similar technologies on an opt-out basis — users must be informed about processing and the option to refuse. This is the headline divergence from EU ePrivacy: no prior opt-in is required for cookies under Swiss law.
  • Art 45c Processing of data on third-party equipment (cookies) — information + opt-out, not prior consent
Federal Act on Telecommunications, SR 784.10
UWG Art 3(1)(o)
Bundesgesetz gegen den unlauteren Wettbewerb
Direct marketing — Art 3(1)(o) prohibits sending mass advertising by electronic means without prior opt-in, identification of the sender, and a free unsubscribe mechanism. Mirrors EU email opt-in standards even though the cookie regime is opt-out.
  • Art 3(1)(o) Email/SMS mass marketing — prior consent + sender identification + free opt-out required
Federal Act Against Unfair Competition, SR 241

Regulators

Supervisory authorities that interpret and enforce privacy law here.

FEDERAL
FDPIC · Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB)
Federal supervisory authority for both private controllers and federal bodies. Issues recommendations and opens investigations; under nFADP can issue binding orders, but cannot levy administrative fines on companies — criminal fines are pursued by cantonal prosecutors against responsible natural persons.
https://www.edoeb.admin.ch/edoeb/en/home.html

State / Land DPAs · 1 authorities

Land / stateAuthorityNote
Cantonal data-protection commissioners Various Each canton has its own commissioner for cantonal/communal public bodies. Private-sector controllers are supervised exclusively by the federal FDPIC. site ↗

Coordination body

privatim · Conference of Swiss Data Protection Commissioners
Coordination body for the cantonal commissioners; non-binding positions, frequently aligned with FDPIC.
  • 2023-09-01 · nFADP entry into force — Joint privatim/FDPIC guidance on transition: existing processing must be brought into line; no grace period.
  • 2023-09-15 · Swiss-US Data Privacy Framework — Federal Council recognized adequacy for Swiss-US DPF-certified US importers — transfers permissible without further safeguards while certification is in force.
  • 2024-06 · AI and personal data — FDPIC position paper on AI systems and nFADP — transparency, purpose limitation, and human-review obligations apply.
https://www.privatim.ch/

Notable enforcement

FDPIC enforcement is recommendation-based, not fine-based. Under both the old and the new FADP, the regulator opens investigations, issues recommendations, and (since nFADP) can issue binding orders, but it cannot levy administrative fines on companies. Criminal fines up to CHF 250,000 are imposed by cantonal prosecutors on the responsible natural person — typically the controller's executive or DPA — for intentional violations of information, access, security, or due-care duties. As a result, no major company-level fines comparable to GDPR enforcement have been published; the FDPIC's leverage is reputational and procedural. Notable investigations include Tamedia (data-broker subsidiary practices) and several Swiss banks on cross-border data sharing.

GA4 status

GA4 is acceptable on Swiss-targeted sites under the nFADP opt-out baseline — informed users with a refusal option satisfy FMG Art 45c. Transfers to Google's US servers are covered by the Swiss-US Data Privacy Framework (recognized 15 Sep 2023) while Google LLC remains DPF-certified. CrUX and aggregate measurement are permissible. Note: if your site also targets the EU, the stricter EU opt-in regime applies in parallel — most multilingual operators run a single GDPR-grade banner anyway.

DPAStance
FDPICPermissive — opt-out information notice + DPF acceptable; recommendation-based posture overall.

Cross-border transfers + Schrems II

Switzerland's adequacy from the EU has been intact since 2000 and was re-confirmed in the 2024 periodic review under GDPR Art 45(3). For transfers from Switzerland to the United States, the Swiss-US Data Privacy Framework has been recognized by the Federal Council since 15 September 2023 — Swiss controllers can rely on it for DPF-certified US importers without additional safeguards while certification is in force. Outside DPF, Swiss controllers use the SCCs adapted with the FDPIC's Swiss-finish addendum, plus a TIA. The FDPIC is markedly less aggressive than German Länder DPAs on TIA review.

FDPIC accepts the EU 2021/914 SCCs with the Swiss-specific amendments published by FDPIC in August 2021 (references to GDPR/EU law replaced or supplemented with FADP/Swiss equivalents).

Topic: International transfers

Employee data

Key thresholds

Article 27 representative
Required
Marketing consent
Double opt-in

Vendor signals

Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.

Analytics tools · 12 · 6 green · 5 yellow · 1 red
VendorStatusRationale
 GREEN Cookieless by design. EU-routed via Cloudflare. No DPA required for Lite tier (no PII).
 GREEN Self-hosted on your infrastructure. Full data control, configurable IP anon. Meets every jurisdiction with cookieless config.
 GREEN EU-hosted with cookieless mode available. With cookies disabled qualifies for §25(2) exception in Germany.
 GREEN German-hosted, cookieless, GDPR-aligned by design.
 GREEN EU-hosted, no cookies, no PII processed. ePrivacy-exempt for cookieless tracking. No banner required.
 GREEN Open-source, cookieless, fully self-hostable. Default-green when self-hosted.
 YELLOW Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation.
 YELLOW EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain.
 YELLOW nFADP allows opt-out baseline. Still need DPF compliance for transfers.
 YELLOW Less strict than EU — opt-out acceptable.
 YELLOW EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green.
 RED Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization.
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
VendorStatusRationale
 GREEN Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate.
 GREEN Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan.
 GREEN Open-source, self-hosted. No managed updates — site owner maintains vendor list.
 GREEN GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults.
 GREEN German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites.
Tag managers · 1 · 0 green · 1 yellow · 0 red
VendorStatusRationale
 YELLOW Container only — verdict depends on which tags fire and when. Block until consent. Server-side GTM in EU recommended.
Session replay · 3 · 0 green · 3 yellow · 0 red
VendorStatusRationale
 YELLOW —
 YELLOW —
 YELLOW —
Ad pixels · 3 · 0 green · 0 yellow · 3 red
VendorStatusRationale
 RED Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set.
 RED Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem.
 RED PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required.
Server-side · 3 · 2 green · 1 yellow · 0 red
VendorStatusRationale
 GREEN EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic.
 GREEN EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings.
 YELLOW "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing.

Compare with neighbors

Side-by-side rule comparison.

COMPARE
Switzerland vs Germany
COMPARE
Switzerland vs France
COMPARE
Switzerland vs EU (general)

Common questions

Does the nFADP apply to non-Swiss companies?
Yes. Art 3 nFADP applies extraterritorially to any processing that has effects in Switzerland — operating a Swiss-targeted website (Swiss-language content, .ch domain, CHF pricing, advertising in Switzerland) is enough to trigger it. Non-Swiss controllers regularly processing Swiss personal data on a significant scale must also designate a Swiss representative under Art 14.
What's the difference between Swiss opt-out and EU opt-in for cookies?
Switzerland uses an opt-out baseline. FMG Art 45c requires that users be informed about cookie processing and given the option to refuse — a clear notice with a refusal mechanism is enough. There is no Swiss equivalent of TDDDG § 25 or ePrivacy Art 5(3) requiring prior, granular consent. If your site also targets the EU, the stricter EU rules apply in parallel and most operators just run a GDPR-grade banner globally.
Can companies be fined under nFADP?
No, not in the GDPR sense. The nFADP keeps Switzerland's tradition of imposing criminal fines (up to CHF 250,000) on the responsible natural person — typically the controller's executive or DPA — for intentional violations of information, access, security, or due-care duties. The FDPIC issues recommendations and binding orders against companies but cannot levy administrative fines on the entity itself.
Is the Swiss-US Data Privacy Framework in force?
Yes, since 15 September 2023. The Federal Council recognized adequacy for US importers self-certified to the Swiss-US DPF — Swiss controllers can transfer personal data without additional safeguards while the importer's certification is in force. Outside the DPF, transfers rely on SCCs adapted with FDPIC's Swiss-finish addendum plus a Transfer Impact Assessment.
How does FDPIC enforce the nFADP?
Investigations and recommendations rather than fines. Under nFADP the FDPIC can also issue binding orders requiring controllers to bring processing into compliance, suspend it, or delete data. Criminal fines on individuals are pursued by cantonal prosecutors based on FDPIC complaints. Practical leverage is reputational — published recommendations and orders carry weight in the Swiss legal-compliance market.
Is Switzerland's EU adequacy still intact?
Yes. The European Commission's 2000 adequacy decision for Switzerland remains in force and was re-confirmed in the first periodic review under GDPR Art 45(3) in early 2024. Personal data flows freely from the EU/EEA to Switzerland without additional safeguards.
Do I need a Swiss DPO?
Not as a hard rule. nFADP Art 10 makes a Data Protection Advisor mandatory only for federal bodies. Private controllers are encouraged to appoint one — designating an Advisor and notifying FDPIC unlocks a procedural exemption from prior consultation on high-risk DPIAs. There is no headcount threshold equivalent to Germany's BDSG § 38.
Do I need a Swiss representative under Art 14?
Yes if you are a non-Swiss controller (private sector) regularly processing Swiss residents' personal data on a significant scale, where the processing is high-risk or involves goods/services offered to Switzerland or behavioral monitoring of people in Switzerland. The representative must be established in Switzerland and act as a contact point for FDPIC and data subjects.
What about email marketing in Switzerland?
Email and SMS mass marketing require prior opt-in under UWG Art 3(1)(o) — sender identification and a free unsubscribe must be present in every message. This mirrors EU rules even though the cookie regime is opt-out. Soft opt-in for existing customers and similar products is generally accepted by analogy with the EU practice.
How does Swiss employee monitoring law affect analytics?
nFADP Art 26-27 plus Code of Obligations Art 328b limit processing of employee data to what is necessary for suitability for the role or performance of the contract. Ordinance 3 to the Labour Act (ArGV 3 Art 26) prohibits surveillance systems whose purpose is monitoring employee behavior. Session-replay on staff-facing dashboards, productivity-tracking pixels, and continuous behavioral analytics on internal apps need a documented necessity case and are typically harder to justify than externally facing analytics.

// EDITORIAL · NOT LEGAL ADVICE This page summarises Switzerland's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.