Cookies and tracking: rules for company websites

Every company website uses cookies and tracking tools, often without whoever manages it knowing exactly which rules apply. In Switzerland the framework differs from the European one, but that does not make it permissive: the new data protection act imposes precise obligations, and for many Swiss companies the GDPR applies on top. Clarifying what is genuinely required avoids both pointless banners on the one hand and violations on the other. Let’s look at the picture in practical terms.

The Swiss framework: the new FADP

Since 1 September 2023 the new Federal Act on Data Protection (FADP) has been in force, modernising the Swiss rules and bringing them closer to European standards without copying them. The underlying logic: processing personal data is lawful, but it must be transparent and respect the principles of purpose and proportionality.

Cookies and tracking tools collect personal data (browsing behaviour, IP address, identifiers). They therefore fall under the FADP and impose, as a minimum, a clear duty to inform the user.

Prior consent: what the Swiss model says

This is the most significant difference from Europe. The Swiss model is framed less rigidly than the mandatory prior consent that characterises the EU approach for many non-essential cookies.

In practical terms, Swiss law places value on transparency: the user must be informed in a comprehensible way about which data is collected, for what purposes and by whom. For certain types of processing the law also provides the possibility to object (opt-out). This does not mean “no obligation”: it means the emphasis is on the notice and on the possibility of control, rather than on generalised prior consent.

Be careful, though: this is the reading on the Swiss level alone. For many companies it is not enough.

Why the GDPR also concerns many Swiss companies

The European GDPR has an extraterritorial reach. It also applies to a company based in Switzerland when that company offers goods or services to people in the European Union or monitors their behaviour.

Concretely, if a Swiss company website:

• also addresses customers in the EU (languages, currencies, shipping);
• tracks European visitors with analytics or profiling tools;

then it is realistic that it must comply also with the GDPR, which for non-technical cookies generally requires prior, free and specific consent, collected through a banner with a genuine possibility to refuse.

This is why many Swiss websites adopt a European-style consent banner: not because the FADP always requires it, but because their audience includes EU users.

Types of cookie: distinguishing is the key

Not all cookies are alike, and the distinction determines the obligations.

• Technical / necessary cookies: essential to the operation of the site (session, cart, security). These are the least problematic.
• Analytics / statistics cookies: measure traffic and user behaviour.
• Marketing / profiling cookies: build profiles for targeted advertising, often from third parties.

The more a cookie shifts towards profiling and third parties, the greater the need for a detailed notice and, where the GDPR applies, for prior consent.

What a compliant company website must have

A solid setup, holding together the FADP and — where needed — the GDPR, rests on a few elements:

• a clear and up-to-date privacy notice, stating which data is collected, for what purposes, who the recipients are and how to exercise one’s rights;
• a cookie policy listing the cookies used, their function and their duration;
• a banner that, if the audience includes EU users, allows non-essential cookies to be accepted or refused with equal ease;
• attention to cross-border data transfers, a central issue when using analytics and marketing tools from foreign providers.

The most common mistakes

Those who run a company website tend to fall into two opposite extremes:

• Underestimating: no notice, third-party cookies active without any transparency. This is the most exposed profile, especially if there are EU users.
• Copying at random: banners and policies taken from other sites, not aligned with the tools actually in use. A notice describing processing different from the real one does not protect; on the contrary, it documents the inconsistency.

The correct path is to start from a real mapping of the tools installed on the site and build the notice on that basis.

Our approach

At SIH ONE we help companies understand which framework applies to their site — FADP only or also the GDPR — starting from the actual audience and the tools genuinely in use. We set up the notice, cookie policy and consent logic coherently, without superfluous banners but without gaps towards European customers.

Do you want to bring your site’s cookies and privacy into compliance? Let’s talk with our legal desk.