Swiss FADP and your website: cookies, forms and outside services

What the law asks of a website

The revised Federal Act on Data Protection (FADP) has been in force since 1 September 2023. It also covers processing abroad if the effects reach Switzerland. For a website, these articles matter most:

• article 19: say who you are, why you collect data, who gets it and in which countries;
• article 7: default settings collect only what's needed;
• articles 16-17: sending data abroad follows the Federal Council's country list or contract clauses;
• article 24: a breach with high risk must be reported to the commissioner (FDPIC) as soon as possible.

Fines reach CHF 250,000 and generally fall on the responsible individual rather than the company, for intentional acts. A fine on the company, up to CHF 50,000, is for cases where finding the person would take disproportionate effort. Cantonal authorities prosecute, and the FDPIC can file a complaint.

Cookies fall under article 45c of the Telecommunications Act and the FDPIC guidelines, updated on 6 October 2025. They aren't binding, but they show how the regulator thinks: non-essential cookies need consent or an overriding interest, and refusing must always be possible.

Where the site says one thing and does another

Privacy policies are often copied from a template, and the site has changed since. Open the page with the browser's developer tools and you'll see calls nobody remembers: Google Fonts, reCAPTCHA, a map, a YouTube video, the pixel from an old campaign. Each one sends IP addresses or cookies to a provider, often outside Switzerland, before the visitor has chosen anything.

Contact forms count too. Where does the message go? Does it sit in a plugin for years? Does the newsletter plugin ask for consent or assume it?

What I do

1. I open the site in a clean browser and record everything that leaves it on the first visit.
2. I give you the list: service, data sent, country, purpose.
3. I remove what you don't use, move fonts and scripts to your own server and block the rest until the visitor can decide.
4. I fix forms and plugins: necessary fields, retention times, where the data ends up.
5. I check updates and backups, with maintenance if you'd like someone to keep at it.

What I don't do

I don't write your privacy policy or tell you whether you're compliant: that's for a lawyer or your adviser. I give them the technical list and put their text on the site. This page summarises the act and FDPIC documents as read on 31 October 2026 and is not legal advice.

Frequently asked questions

Does a Swiss website need a cookie banner?

Not always. The Telecommunications Act (article 45c) requires you to inform visitors and let them refuse. The commissioner's guidelines add explicit consent for high-risk profiling or tracking across several sites. If your site also targets people in the EU, it usually makes sense to follow the stricter EU rules.

Can I use Google Analytics?

The commissioner accepts visitor analysis if data is anonymised as soon as possible and the provider handles it only on your behalf, without using it for itself. So it depends on the setup. A cookie-free tool hosted on your own server is often simpler.

Do I need a record of processing activities?

Below 250 staff you're exempt if your processing carries only a low risk. With large amounts of sensitive data or high-risk profiling, you need the record anyway.

My site is Swiss and I have customers in Italy. Which law applies?

Often both: the FADP for what you do in Switzerland and the GDPR if you offer goods or services to people in the EU. Check with a lawyer, because it depends on how you sell.

If you are in Ticino or elsewhere in Switzerland

I work from Rovellasca, near Como, between Milan and the Swiss border, and part-time at a communication agency in Switzerland. For a Swiss company I built the AREAVISION website, business app and mobile app.

Read more

• The service: Website maintenance
• More pages like this: Rules to comply with in Switzerland