Swiss FADP and GDPR: what your website really needs
Swiss law, EU law, cookies, Google Fonts and tracking. The key data protection rules for websites, clearly explained with a practical checklist.
Data protection sounds like legal clauses and box ticking. For your website, it is above all a question of trust. Visitors notice whether a site respects them: in the cookie banner, in the loading time and in the services quietly listening in the background.
Two laws, one website
Since 1 September 2023, Switzerland has applied its revised Federal Act on Data Protection, the FADP. It is modelled on the European General Data Protection Regulation, the GDPR, but takes a more pragmatic approach in some respects.
The GDPR also applies to Swiss companies as soon as they offer goods or services to people in the EU or analyse their behaviour. If you operate internationally, it is best to align your website with both sets of rules from the start.
The five most important points
1. A complete privacy policy
It explains which data your website collects, why and to whom it is passed on. This includes server log files, contact forms, analytics and every embedded third-party service.
2. Cookies and consent
In Switzerland, clear information is usually enough. For visitors from the EU, all non-essential cookies require active consent. The simplest solution is to do without such cookies altogether. Then the banner disappears too.
3. Fonts and third-party services
If fonts are loaded directly from Google’s servers, the browser sends the visitor’s IP address to Google. A German court ruled this a data protection breach in 2022. The fix is simple: fonts, images and videos belong on your own server.
4. Analytics with a sense of proportion
If you want to know how your website is used, you do not necessarily need Google Analytics. Tools such as Matomo run on your own infrastructure, without cookies and with anonymised IP addresses. The figures are enough for sound decisions, and your visitors are not watched.
5. Secure forms
Contact forms must be transmitted encrypted and should only ask for data you really need. A link to the privacy policy right next to the form creates transparency.
Checklist for your website
- HTTPS on every page
- an up-to-date privacy policy under the FADP and, if needed, the GDPR
- fonts and media on your own server
- no tracking cookies without consent
- analytics without cookies or with proper consent
- contact form with minimal required fields
- imprint with complete company details
How we do it
This website is the best example: no tracking cookies, no external fonts, analytics on our own infrastructure. That is why it needs no cookie banner. We are happy to build your website on the same principles. Find out more about our consulting.
This article provides an overview and does not constitute legal advice.
Frequently asked questions
Do I need a cookie banner in Switzerland?
Swiss data protection law generally does not require prior consent for cookies, but it does require transparent information. If your website also targets people in the EU, the stricter European rules with consent apply.
Can I use Google Analytics?
In principle yes, with a correct privacy policy and, for EU visitors, consent. Privacy-friendly alternatives such as Matomo on your own infrastructure often spare you the cookie banner entirely.
Who is liable for breaches of the revised FADP?
The Swiss law provides for fines of up to 250,000 francs. Unlike in the EU, they are aimed primarily at the responsible individuals and require intent.