Open workspace

Guide · Swiss regulation

FADP: the Swiss data law explained for people who live off ads

Switzerland is not part of the European Union and has its own data law, revised in 2023. It is more flexible than the GDPR in some ways and tougher in one: the fine falls on the responsible individual. Here is what applies to cookies, banners and Google ads with Swiss visitors.

Audit my Switzerland trafficRead the guide
  • ✓Based on the federal law and the Swiss regulator's official guidance
  • ✓Examples of sites with ads, including Brazilian ones
  • ✓Read-only scan, no changes to the site
CHF 250,000maximum fine, applied to the responsible individual and not to the company
2023year the revised law came into force, on September 1, with no transition period
250employees: below this, companies with low-risk processing can skip the record of processing activities
CHF 5,000maximum fine under the telecommunications law for anyone who breaks the cookie rule

What it is

Its own law, similar to the GDPR but not the same

The Swiss Federal Act on Data Protection, known as the FADP in English, nLPD in French and nDSG in German, was revised by Parliament in 2020 and came into force on September 1, 2023. The new version brought the Swiss law closer to the European GDPR but kept its own logic.

Under the GDPR, every processing of personal data needs a legal basis. In Switzerland, processing is allowed as long as it respects the principles of the law, such as transparency, purpose limitation and proportionality. A justification, such as consent or an overriding interest, is only required when the processing breaches those principles or the person's personality rights.

Enforcement is in the hands of the Federal Data Protection and Information Commissioner, the FDPIC, called PFPDT in French and EDÖB in German. It investigates, issues orders and publishes guidance, but does not impose fines. The fines are criminal and are handled by the cantonal authorities.

Cookies also follow a rule in the telecommunications law. It requires the site to disclose the use and purpose of cookies and to let the visitor refuse them. The FDPIC's guidance explains how these two laws fit together.

Checklist

What you need to meet

These are the points that the FDPIC guidance and Google require from a site with ads that receives visitors from Switzerland.

  1. Use a Google-certified CMP

    Since July 31, 2024, Google requires a certified CMP integrated with the IAB TCF to show personalized ads in Switzerland. Without one, Swiss traffic can only receive non-personalized or limited ads.

    Example

    Include Switzerland in the CMP regions, because it is not part of the European Union or the EEA.

  2. Always let people refuse cookies

    The FDPIC says the site must always give the visitor the option to refuse cookies that are not essential. The refuse option must be clearly visible.

    Example

    The banner shows a visible Refuse button, and not just a small link in the text.

  3. Do not use a banner with only accept all

    For the FDPIC, a window that only allows accepting everything is not a clear declaration of consent. This weighs even more when it mixes essential cookies with cookies that require consent.

  4. Ask for express consent in high-risk cases

    Sensitive data and high-risk profiling require express consent. The FDPIC explains that ad tracking across several sites can reach that level. If in doubt, check with your legal team.

    Example

    Third-party ad cookies are only stored after an active click on accept.

  5. Inform at the time of collection

    The visitor must be informed when data is collected, in layers, with the most important information first. It is not enough to put the privacy policy in a hidden corner of the site.

    Example

    The banner summarizes the use of cookies and leads to the full policy with one click.

  6. Say who receives the data and in which country

    The policy must say when data goes to third parties or service providers, and for what purpose. If the data leaves Switzerland, the destination country must also be stated.

    Example

    In the policy: we use Google and other ad networks, and data may be sent to the United States.

  7. Do not make withdrawing consent difficult

    According to the FDPIC, requiring much more effort to withdraw consent than to give it undermines voluntariness. Pre-ticked boxes are only accepted where express consent is not required.

    Example

    A fixed link in the footer reopens the preferences with one click.

In practice

Right and wrong

Official tools

Certified CMPs and official links

For personalized ads in Switzerland, Google requires a certified CMP, and these are the official pages to choose and set one up.

Who it applies to and definitions

What the law covers

The law looks at the effect in Switzerland, not at the company's address. These are the concepts that matter most for a site with ads.

Effect in Switzerland

The law applies to situations that have an effect in the country, even if the site is hosted and run somewhere else.

Individuals only

The new version protects only the data of individuals. Data about companies is no longer covered.

Sensitive data

Includes health, ethnic origin, religion, political opinion, genetic and biometric data and criminal proceedings. It calls for care and, often, express consent.

High-risk profiling

This is the combining of data that makes it possible to assess essential aspects of someone's personality. Ad tracking across several sites can reach this level.

Controller and processor

The controller decides the purpose and the means, like the site owner. The processor handles data on their behalf, like a hosting provider.

Representative in Switzerland

Foreign companies that offer products to or monitor people in the country need a local representative when the processing is regular, large-scale and high-risk.

Consent and cookies

When notice is enough and when you must ask

The basic rule for cookies in Switzerland is to inform and let people refuse. The site must say, at the time of collection, that it uses cookies and what for, and remind the visitor that they can say no. The FDPIC's guidance makes clear that the right to refuse is mandatory in every scenario.

Express consent, with an active click on a button or a box, is required in higher-risk cases: processing of sensitive data and high-risk profiling. It also applies to sites with political, trade union or religious content when the cookies go beyond what is expected.

The updated version of the guidance, published in October 2025, deals with advertising. It explains that third-party cookies spread across many sites, which hand over visitor data in exchange for payment, can amount to high-risk profiling. If the site cannot rule out that risk, it must treat it as high and ask for express consent.

On the banner, the FDPIC says that a window offering only accept all does not produce clear consent, that refusing must be visible and that withdrawing consent cannot be harder than giving it. Pre-ticked boxes are only accepted for uses that do not require express consent.

People's rights

What a Swiss visitor can ask for

The site needs a contact for receiving requests and must answer within the deadline.

Access

Find out whether the site processes data about them and receive the information provided for by law, as a rule within 30 days and free of charge.

Correction and deletion

Ask for wrong data to be corrected and for unlawfully processed data to be deleted.

Objection

Object to processing, including refusing cookies. Under the telecommunications law, this refusal must always be possible.

Portability

Receive the data they provided in a common electronic format or ask for it to be sent to another company.

Human review

Be informed about decisions made only by an automated system that have a significant effect, and ask for a person to review them.

Information at collection

Be told who is collecting, for what, who it is shared with and to which countries the data goes.

Obligations

What a site with Swiss visitors must do

  1. Inform at the time of collectionHave a privacy policy with the identity and contact of the controller, the purposes, the recipients and the countries the data goes to. The guidance asks for layered information, with the main points first, and never hidden in a corner of the page.
  2. Offer a way to refuse cookiesShow a cookie notice with a clear option to refuse. For ads with cross-site tracking, prefer express consent, which is also what Google requires for personalized ads.
  3. Start with the minimumThe law calls for privacy by design and by default. In practice, nothing that is not essential should run just because the page loaded.
  4. Assess the riskCarry out an impact assessment before high-risk processing and keep a record of processing activities, unless the company has fewer than 250 employees and only low-risk processing.
  5. Report breachesNotify the FDPIC as soon as possible when a breach could bring a high risk to people, and tell those affected when that is needed to protect them.
  6. Handle transfersSending data outside Switzerland requires a country with adequate protection or safeguards such as contractual clauses. For the United States, companies certified under the Swiss-U.S. Data Privacy Framework have been accepted since September 15, 2024.

Enforcement and fines

In Switzerland, the person pays

Unlike the GDPR, the Swiss fine is not calculated on the company's revenue. It is criminal and targets the individual who decided on or carried out the violation.

Up to CHF 250,000

A fine for the responsible individual who willfully breaks duties such as informing, answering access requests or protecting data when transferring it.

Company only as an exception

When finding the responsible person would require a disproportionate investigation, the company can be fined in their place, as long as the fine does not exceed CHF 50,000.

FDPIC orders

The commissioner investigates and can order that the processing be corrected or suspended, or that the data be deleted. Disobeying the order is also a crime.

Cookie rule

The telecommunications law provides for a fine of up to CHF 5,000 for anyone who, willfully or through negligence, fails to inform and to let visitors refuse.

Timeline

The dates that matter

From the approval of the revised law to the latest update of the cookie guidance.

  1. September 25, 2020

    Revised law passed

    The Swiss Parliament approves the full revision of the data protection law.

  2. September 1, 2023

    Entry into force

    The new law and the ordinance that implements it start to apply, with no transition period for most of the rules.

  3. July 31, 2024

    Google requires a certified CMP

    For personalized ads to visitors from Switzerland, AdSense and Ad Manager start requiring a certified CMP integrated with the IAB TCF.

  4. September 15, 2024

    Agreement with the United States

    US companies certified under the Swiss-U.S. Data Privacy Framework are now considered an adequate destination for data.

  5. January 2025

    Cookie guidance

    The FDPIC publishes its guidance on processing data with cookies and similar technologies.

  6. October 2025

    Updated guidance

    Version 1.1 details personalized advertising, location data and the pay-or-accept model.

For people with AdSense or Ad Manager

What changes in practice for revenue

Since July 31, 2024, Google requires the same for visitors from Switzerland as it does for the European Economic Area and the United Kingdom: a certified CMP integrated with the IAB TCF. Without it, Swiss traffic receives only non-personalized or limited ads.

This means that, even if the Swiss law is content with informing and letting people refuse in some cases, anyone who wants personalized Google ads needs consent recorded in the TC string. In practice, Google's standard ends up being the strictest.

A common example: a Brazilian job site in French that gets visitors from Geneva and Lausanne. If the CMP was set up only for the European Union, Switzerland is left out, because it is a member of neither the Union nor the EEA. The result is Swiss traffic with no TC string and with limited ads.

The Privacy & messaging tool in AdSense and Ad Manager is already certified and lets you include Switzerland. With another CMP, check that Switzerland appears in the list of regions and that Google is among the vendors.

In practice

What is and is not allowed with Swiss visitors

Everyday examples from content, job and finance sites with an audience in Switzerland.

Allowed

  • Use essential cookies, such as the one that stores the banner choice, without asking for consent
  • Disclose the use of cookies in layers, with the summary in the banner and the detail on the privacy page
  • Include Switzerland in the same CMP setup used for the EEA and the United Kingdom
  • Show non-personalized ads to people who refused
  • Offer a permanent link in the footer so visitors can change their choice

Not allowed

  • Show a banner with only an accept all button
  • Fire third-party remarketing pixels before any response
  • Forget Switzerland because it is not part of the European Union
  • Make withdrawing consent harder than accepting
  • Hide the privacy policy in a hard-to-find corner

Common errors

Where sites slip up most

Failures that often appear on sites with Swiss traffic.

Switzerland missing from the list of regions

The CMP shows the message for the European Union but not for Switzerland. Google receives requests without valid consent and limits the ads.

Relying only on opt-out

The law accepts informing and letting people refuse in some cases, but cross-site ad tracking may require express consent, and Google requires consent in order to personalize.

Thinking the fine is the company's problem

In Switzerland, the criminal fine falls on the person who made the decision. The site owner, manager or technical lead can be held personally liable.

Policy without destination countries

The law requires you to say which countries the data goes to. Many texts mention Google and forget to say that the data leaves Switzerland.

Banner that does not honor the refusal

The visitor clicks reject and the ad cookies are still there. The guidance says a refusal blocked by the site cannot be held against the visitor.

Pay or accept without care

Making access conditional on accepting tracking or paying for a subscription is treated in the guidance with its own conditions. Copying another country's model without review is risky.

In ConsentMode

What the audit checks for Switzerland

  • Opens the site as a visitor from Switzerland and records whether the banner appears, which buttons it offers and whether the refusal is visible.
  • Identifies the CMP from the page code and checks whether it is on Google's list of certified CMPs.
  • Reads the TC string and the Consent Mode signals sent in the ad requests.
  • Compares cookies and network requests before and after the choice and points out what fires too early.
  • Checks that the privacy policy includes the controller, purposes, recipients and destination countries.
Run an auditSee everything that is checked

Frequently asked questions

My site is Brazilian. Does the Swiss law apply to me?

The law reaches situations with an effect in Switzerland, even if they start abroad. If the site tracks Swiss visitors for ads, there is an effect in the country. And Google requires a certified CMP to personalize ads for this audience, regardless of where the site is.

In Switzerland, can the banner be informational only?

For low-risk cookies, the law accepts informing and offering a way to refuse. For cross-site ad tracking, sensitive data or high-risk profiling, express consent is required. For personalized Google ads, a certified CMP with consent is mandatory.

Who enforces it and who fines?

The FDPIC investigates, gives guidance and can issue orders. Fines are imposed by the cantonal criminal authorities.

Can the fine reach the site owner?

Yes. The fine of up to CHF 250,000 is imposed on the individual responsible for the willful violation. The company is only fined in exceptional cases.

Do I need a representative in Switzerland?

Only if the company is outside the country and processes data of people in Switzerland on a regular basis, on a large scale and with high risk. Most small and mid-sized content sites do not reach that level, but it is worth assessing.

I use the same CMP as for the GDPR. Do I need something different?

Usually not. Just confirm that Switzerland is in the configured regions and that the banner and policy texts also meet the Swiss law, such as mentioning destination countries.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See how your site appears to a Swiss visitor

The audit opens the site from Switzerland, records the banner, the TC string and the cookies and shows what to fix, without changing anything.

Start the audit