GA4 & Cookie Consent in Switzerland — nFADP, FDPIC Rules (2026)

// SCOPE

Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Switzerland. Switzerland's nFADP is non-EU but harmonized with GDPR; the opt-out baseline plus individual criminal liability define the local twist.

Applicable laws

The legal framework that governs personal data processing here.

NATIONAL · 2023-09-01

nFADP

Swiss Federal Act on Data Protection (revised, 2023)

1 jurisdictions · max —

National addons

Country-specific statutes layered on the EU baseline.

nFADP

Bundesgesetz über den Datenschutz (FADP, SR 235.1)

Federal data-protection statute applying to processing of personal data of natural persons by private controllers and federal bodies. Harmonized with GDPR (transparency, breach notification, ROPA, DPIA, profiling) but retains distinctly Swiss features: opt-out baseline for many processing activities, criminal liability on natural persons (not undertakings), and a recommendation-based regulator.

Art 10 Data Protection Advisor — recommended for private controllers, mandatory only for federal bodies (no headcount threshold equivalent to BDSG § 38)
Art 14 Representative — non-Swiss controllers regularly processing Swiss data of significant scale must designate a Swiss representative
Art 19-21 Information duties + automated decision-making — transparency and a right to human review
Art 22 Data Protection Impact Assessment — required for high-risk processing
Art 24 Breach notification — to FDPIC as soon as possible (no 72-hour hard deadline as in GDPR)
Art 26-27 Employee data — processing limited to suitability for the position or performance of the contract; read alongside Code of Obligations Art 328b
Art 60-66 Criminal provisions — intentional breaches of information, access, security, or duty of care punishable by fines up to CHF 250,000 imposed on the responsible natural person

Revised FADP (revFADP / nFADP / nLPD), entered into force 1 September 2023; replaces the 1992 FADP.

FMG

Telekommunikationsgesetz (Loi sur les télécommunications)

Electronic-communications privacy. Art 45c regulates cookies and similar technologies on an opt-out basis — users must be informed about processing and the option to refuse. This is the headline divergence from EU ePrivacy: no prior opt-in is required for cookies under Swiss law.

Art 45c Processing of data on third-party equipment (cookies) — information + opt-out, not prior consent

Federal Act on Telecommunications, SR 784.10

UWG Art 3(1)(o)

Bundesgesetz gegen den unlauteren Wettbewerb

Direct marketing — Art 3(1)(o) prohibits sending mass advertising by electronic means without prior opt-in, identification of the sender, and a free unsubscribe mechanism. Mirrors EU email opt-in standards even though the cookie regime is opt-out.

Art 3(1)(o) Email/SMS mass marketing — prior consent + sender identification + free opt-out required

Federal Act Against Unfair Competition, SR 241

Regulators

Supervisory authorities that interpret and enforce privacy law here.

FEDERAL

FDPIC · Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB)

Federal supervisory authority for both private controllers and federal bodies. Issues recommendations and opens investigations; under nFADP can issue binding orders, but cannot levy administrative fines on companies — criminal fines are pursued by cantonal prosecutors against responsible natural persons.

https://www.edoeb.admin.ch/en

State / Land DPAs · 1 authorities

Land / state	Authority	Note
Cantonal data-protection commissioners	Various	Each canton has its own commissioner for cantonal/communal public bodies. Private-sector controllers are supervised exclusively by the federal FDPIC.	site ↗

Coordination body

privatim · Conference of Swiss Data Protection Commissioners

Coordination body for the cantonal commissioners; non-binding positions, frequently aligned with FDPIC.

2023-09-01 · nFADP entry into force — Joint privatim/FDPIC guidance on transition: existing processing must be brought into line; no grace period.
2023-09-15 · Swiss-US Data Privacy Framework — Federal Council recognized adequacy for Swiss-US DPF-certified US importers — transfers permissible without further safeguards while certification is in force.
2024-06 · AI and personal data — FDPIC position paper on AI systems and nFADP — transparency, purpose limitation, and human-review obligations apply.

https://www.privatim.ch/

Notable enforcement

FDPIC enforcement is recommendation-based, not fine-based. Under both the old and the new FADP, the regulator opens investigations, issues recommendations, and (since nFADP) can issue binding orders, but it cannot levy administrative fines on companies. Criminal fines up to CHF 250,000 are imposed by cantonal prosecutors on the responsible natural person — typically the controller's executive or DPA — for intentional violations of information, access, security, or due-care duties. As a result, no major company-level fines comparable to GDPR enforcement have been published; the FDPIC's leverage is reputational and procedural. Notable investigations include Tamedia (data-broker subsidiary practices) and several Swiss banks on cross-border data sharing.

GA4 status

GA4 is acceptable on Swiss-targeted sites under the nFADP opt-out baseline — informed users with a refusal option satisfy FMG Art 45c. Transfers to Google's US servers are covered by the Swiss-US Data Privacy Framework (recognized 15 Sep 2023) while Google LLC remains DPF-certified. CrUX and aggregate measurement are permissible. Note: if your site also targets the EU, the stricter EU opt-in regime applies in parallel — most multilingual operators run a single GDPR-grade banner anyway.

DPA	Stance
FDPIC	Permissive — opt-out information notice + DPF acceptable; recommendation-based posture overall.

Cross-border transfers + Schrems II

Switzerland's adequacy from the EU has been intact since 2000 and was re-confirmed in the 2024 periodic review under GDPR Art 45(3). For transfers from Switzerland to the United States, the Swiss-US Data Privacy Framework has been recognized by the Federal Council since 15 September 2023 — Swiss controllers can rely on it for DPF-certified US importers without additional safeguards while certification is in force. Outside DPF, Swiss controllers use the SCCs adapted with the FDPIC's Swiss-finish addendum, plus a TIA. The FDPIC is markedly less aggressive than German Länder DPAs on TIA review.

FDPIC accepts the EU 2021/914 SCCs with the Swiss-specific amendments published by FDPIC in August 2021 (references to GDPR/EU law replaced or supplemented with FADP/Swiss equivalents).

Topic: International transfers

Employee data

Employee monitoring — when analytics enters HR

Swiss employee-monitoring rules sit at the intersection of nFADP Art 26-27 and Code of Obligations (OR) Art 328b, which limits employer processing to data necessary for suitability for the role or performance of the contract. Continuous behavioral monitoring of employees is generally prohibited; Ordinance 3 to the Labour Act (ArGV 3 Art 26) bans surveillance systems whose purpose is monitoring employee behavior. Pixel-level analytics on internal dashboards, productivity-tracking SaaS, and session-replay on staff-facing applications can cross this line. Worker representation is weaker than in Germany (no Betriebsrat with co-determination as a hard rule), but consultation duties under the Mitwirkungsgesetz apply where staff representations exist.

Key thresholds

Article 27 representative

Required

Marketing consent

Double opt-in

Vendor signals

Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.

Analytics tools · 12 · 8 green · 3 yellow · 1 red

Vendor	Status	Rationale
Fathom	GREEN	Cookieless, aggregate-only; no Art 45c trigger.
Matomo (self-hosted)	GREEN	Self-hosted, full controller control — FDPIC-friendly default.
Matomo Cloud	GREEN	EU-hosted; nFADP + EU adequacy keep this clean.
Pirsch	GREEN	EU-hosted, designed for cookieless deployment.
Plausible	GREEN	Cookieless and aggregate; trivially compliant under FMG Art 45c.
Umami	GREEN	Open-source self-hosted; cookieless default.
Adobe Analytics	YELLOW	Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation.
Amplitude	YELLOW	EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain.
Google Analytics 4	GREEN	nFADP opt-out baseline + Swiss-US DPF (Sep 2023). More permissive than EU; flips to yellow if site also targets EU and runs EU opt-in.
Mixpanel	GREEN	DPF coverage available; opt-out information sufficient under FMG Art 45c.
PostHog	YELLOW	EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green.
Heap	RED	Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization.

Consent management platforms · 5 · 5 green · 0 yellow · 0 red

Vendor	Status	Rationale
Cookiebot	GREEN	Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate.
Iubenda	GREEN	Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan.
Klaro	GREEN	Open-source, self-hosted. No managed updates — site owner maintains vendor list.
OneTrust	GREEN	GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults.
Usercentrics	GREEN	German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites.

Tag managers · 1 · 0 green · 1 yellow · 0 red

Vendor	Status	Rationale
Google Tag Manager	YELLOW	Container only — verdict depends on the tags loaded; gate any non-essential tag.

Session replay · 3 · 0 green · 2 yellow · 1 red

Vendor	Status	Rationale
FullStory	RED	Full-session capture remains highest-risk even under nFADP — DPIA + explicit consent recommended.
Hotjar	YELLOW	Session replay = high-risk processing; Art 22 DPIA recommended, but more permissive than EU under nFADP opt-out.
Microsoft Clarity	YELLOW	Session replay + Microsoft tracking — DPIA advisable; opt-out baseline still applies.

Ad pixels · 3 · 0 green · 2 yellow · 1 red

Vendor	Status	Rationale
LinkedIn Insight Tag	RED	Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set.
Meta Pixel	YELLOW	DPF covers transfers; advanced matching still flagged. Less hostile environment than EU but document the lawful basis.
TikTok Pixel	YELLOW	PRC parent-ownership unresolved internationally; FDPIC has not banned but expects transparency + risk assessment.

Server-side · 3 · 2 green · 1 yellow · 0 red

Vendor	Status	Rationale
Addingwell	GREEN	EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic.
Stape	GREEN	EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings.
Server-side GTM (Google Cloud)	YELLOW	"EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing.

Compare with neighbors

Side-by-side rule comparison.

COMPARE

Switzerland vs Germany

COMPARE

Switzerland vs France

Common questions

Does the nFADP apply to non-Swiss companies?

Yes. Art 3 nFADP applies extraterritorially to any processing that has effects in Switzerland — operating a Swiss-targeted website (Swiss-language content, .ch domain, CHF pricing, advertising in Switzerland) is enough to trigger it. Non-Swiss controllers regularly processing Swiss personal data on a significant scale must also designate a Swiss representative under Art 14.

What's the difference between Swiss opt-out and EU opt-in for cookies?

Switzerland uses an opt-out baseline. FMG Art 45c requires that users be informed about cookie processing and given the option to refuse — a clear notice with a refusal mechanism is enough. There is no Swiss equivalent of TDDDG § 25 or ePrivacy Art 5(3) requiring prior, granular consent. If your site also targets the EU, the stricter EU rules apply in parallel and most operators just run a GDPR-grade banner globally.

Can companies be fined under nFADP?

No, not in the GDPR sense. The nFADP keeps Switzerland's tradition of imposing criminal fines (up to CHF 250,000) on the responsible natural person — typically the controller's executive or DPA — for intentional violations of information, access, security, or due-care duties. The FDPIC issues recommendations and binding orders against companies but cannot levy administrative fines on the entity itself.

Is the Swiss-US Data Privacy Framework in force?

Yes, since 15 September 2023. The Federal Council recognized adequacy for US importers self-certified to the Swiss-US DPF — Swiss controllers can transfer personal data without additional safeguards while the importer's certification is in force. Outside the DPF, transfers rely on SCCs adapted with FDPIC's Swiss-finish addendum plus a Transfer Impact Assessment.

How does FDPIC enforce the nFADP?

Investigations and recommendations rather than fines. Under nFADP the FDPIC can also issue binding orders requiring controllers to bring processing into compliance, suspend it, or delete data. Criminal fines on individuals are pursued by cantonal prosecutors based on FDPIC complaints. Practical leverage is reputational — published recommendations and orders carry weight in the Swiss legal-compliance market.

Is Switzerland's EU adequacy still intact?

Yes. The European Commission's 2000 adequacy decision for Switzerland remains in force and was re-confirmed in the first periodic review under GDPR Art 45(3) in early 2024. Personal data flows freely from the EU/EEA to Switzerland without additional safeguards.

Do I need a Swiss DPO?

Not as a hard rule. nFADP Art 10 makes a Data Protection Advisor mandatory only for federal bodies. Private controllers are encouraged to appoint one — designating an Advisor and notifying FDPIC unlocks a procedural exemption from prior consultation on high-risk DPIAs. There is no headcount threshold equivalent to Germany's BDSG § 38.

Do I need a Swiss representative under Art 14?

Yes if you are a non-Swiss controller (private sector) regularly processing Swiss residents' personal data on a significant scale, where the processing is high-risk or involves goods/services offered to Switzerland or behavioral monitoring of people in Switzerland. The representative must be established in Switzerland and act as a contact point for FDPIC and data subjects.

What about email marketing in Switzerland?

Email and SMS mass marketing require prior opt-in under UWG Art 3(1)(o) — sender identification and a free unsubscribe must be present in every message. This mirrors EU rules even though the cookie regime is opt-out. Soft opt-in for existing customers and similar products is generally accepted by analogy with the EU practice.

How does Swiss employee monitoring law affect analytics?

nFADP Art 26-27 plus Code of Obligations Art 328b limit processing of employee data to what is necessary for suitability for the role or performance of the contract. Ordinance 3 to the Labour Act (ArGV 3 Art 26) prohibits surveillance systems whose purpose is monitoring employee behavior. Session-replay on staff-facing dashboards, productivity-tracking pixels, and continuous behavioral analytics on internal apps need a documented necessity case and are typically harder to justify than externally facing analytics.

// EDITORIAL · NOT LEGAL ADVICE This page summarises Switzerland's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.