Swiss FADP: cookie rules in Switzerland
Switzerland does not require prior consent for most cookies. Article 45c of the Telecommunications Act requires websites to tell visitors that data is processed on their device, for what purpose, and that they can refuse, and the revised Federal Act on Data Protection, in force since 1 September 2023, adds a duty to inform and requires express consent only for sensitive data and high-risk profiling. The FDPIC's 2025 cookie guidelines describe an opt-out model with a prominent Reject option as the baseline, and opt-in for intrusive tracking. Breaches are criminal offenses punished by fines of up to CHF 250,000 against the responsible individuals.Quick facts
| Applies to | Any processing that has an effect in Switzerland, even if initiated abroad (FADP Article 3) |
| Consent model | Information and a right to refuse (opt-out) for cookies under TCA Article 45c; express consent (opt-in) for sensitive data and high-risk profiling (FADP Article 6(7)) |
| Cookie rule | TCA Article 45c: data may be processed on a user's device only if users are informed about the processing and its purpose and told they may refuse |
| Maximum fine | CHF 250,000, a criminal fine imposed on the responsible private individual (FADP Articles 60 to 63); up to CHF 50,000 against the business itself in some cases (Article 64) |
| Authority | Federal Data Protection and Information Commissioner (FDPIC) for investigations and orders; cantonal prosecutors for fines |
| In force since | 1 September 2023 (revised FADP and its ordinance); TCA Article 45c since 1 April 2007 |
What is the Swiss FADP?
The Federal Act on Data Protection (FADP, in German DSG, in French LPD) was fully revised by Parliament on 25 September 2020 and the new version entered into force on 1 September 2023, with the Data Protection Ordinance. It brought Swiss law close to the GDPR on transparency, data subject rights, breach notification and data transfers, which helped Switzerland keep its EU adequacy status. The rule on cookies itself sits elsewhere, in Article 45c of the Telecommunications Act (TCA, in German FMG), in force since 2007. The Federal Data Protection and Information Commissioner (FDPIC) published guidelines on cookies and similar technologies on 22 January 2025, updated on 6 October 2025, that read the two laws together.
Who does it apply to?
FADP Article 3 applies the law to circumstances that have an effect in Switzerland, even if they were initiated abroad. A foreign website that tracks visitors in Switzerland is covered. TCA Article 45c protects users of Swiss telecommunications networks in the same way. There is no size threshold, and the duties apply to private persons and companies as well as to federal bodies.
What do the laws require for cookies and trackers?
Article 45c TCA says that processing data on external equipment by telecommunications transmission is permitted only for telecommunications services and charging purposes, or if users are informed about the processing and its purpose and informed that they may refuse to allow processing. That is an information duty plus a right to refuse, not a consent requirement. The FDPIC's guidelines draw the practical consequences:
- Technically necessary cookies (session, login, shopping cart, security, storing the cookie choice itself) need no separate consent and can only be refused indirectly, by leaving the site.
- Non-essential cookies require the Article 45c information and a working opt-out: visitors must be told, before the cookies are set, what they do and how to refuse, and refusing must be possible in a few clicks. The FDPIC treats the opt-out as mandatory and as the measure that makes the processing proportionate.
- Express consent (opt-in) is required where the FADP demands it: processing sensitive personal data, high-risk profiling by a private person (Article 6(7)), and any profiling by a federal body. The guidelines describe intrusive cross-site advertising profiles as the typical case. Consent is only valid if given voluntarily, for specific processing, after appropriate information (Article 6(6)); it must be an active click on a button or box on the first visit, and a prominent notice must allow withdrawal at any time.
- Cookie paywalls (consent or pay) can be acceptable if the price is proportionate and does not undermine the right to data protection.
The general duty to inform (FADP Article 19) applies on top: identity and contact details of the controller, purposes, recipients, and the countries data is sent to, usually in the privacy policy. Google Analytics, advertising pixels and similar tools transfer data to the United States and must be covered by the Swiss-US Data Privacy Framework or standard contractual clauses.
What must a compliant banner do?
For Switzerland alone, a compliant setup is a clear notice with a Reject option that works before non-essential cookies are set, and a privacy policy that meets Article 19. The FDPIC asks for privacy-friendly default settings, a prominent placement and a refuse option that cannot be missed, with opt-in reserved for intrusive tracking. In practice that means:
- a first layer that names the purposes (statistics, advertising, embedded content) and the third parties involved;
- a Reject option on that first layer, not behind a settings link;
- an Accept option, or per-category switches, for the uses that need express consent;
- a link to the privacy policy and a way to change the choice later.
Most Swiss sites nevertheless deploy an EU-style consent banner, because they also serve visitors in the EU and because a banner with Accept and Reject of equal weight satisfies both regimes.
Enforcement and fines
Enforcement works differently from the EU. The FDPIC investigates, can order a controller to change, suspend or stop processing, and can publish its findings, but it cannot fine. Fines are criminal: on complaint, a private person who wilfully provides false or incomplete information, fails to inform data subjects as required by Article 19, breaches the duties of care on transfers abroad, processors and minimum security, ignores an FDPIC ruling, or breaks professional confidentiality faces a fine of up to CHF 250,000 (Articles 60 to 63). The fine targets the responsible individual, typically a manager; when identifying the individual would require disproportionate effort and the fine under consideration does not exceed CHF 50,000, the business can be ordered to pay instead (Article 64). Cantonal prosecutors handle these proceedings. No cookie-related fine has been published so far; the practical risk for a website is an FDPIC investigation and a public order.
How Cookiequiet handles Swiss law
Switzerland is in Cookiequiet's list of regulated countries, so Swiss visitors see the banner when geo-targeting is on. The default design, with Accept all and Reject all of the same size and weight and nothing pre-ticked, meets the FDPIC's opt-out baseline and gives you opt-in where the FADP requires it. Non-essential scripts and embeds stay blocked until the visitor chooses, the consent log records the choice as proof, and the privacy policy generator includes a Swiss FADP template with the Article 19 items and the FDPIC as the authority. The strings exist in German, French and Italian, picked from the visitor's browser. Policies are templates, not legal advice. See also Google Fonts and the GDPR for the transfer question.