In short: In Switzerland, article 45c of the Telecommunications Act requires every website to inform visitors about cookies, explain what they are for and let them refuse, while the revised Federal Act on Data Protection (FADP) decides when an opt-out is enough and when express opt-in consent is required. The rules apply to Swiss businesses and to foreign websites whose tracking has an effect in Switzerland. Breaches can lead to binding orders from the FDPIC and to criminal fines of up to CHF 250,000 for the individuals responsible.
nFADP: what is it?
The nFADP, or "new FADP", is the informal name for Switzerland's totally revised Federal Act on Data Protection of 25 September 2020 (SR 235.1). It entered into force on 1 September 2023 and repealed the Federal Act on Data Protection of 19 June 1992. Official texts call it simply the FADP. English is not an official language of the Swiss Confederation, so the English version on Fedlex is a translation for information only, with no legal force.
The FADP governs any processing of personal data by private persons and federal bodies. For cookies, it works together with a much older and much shorter provision: article 45c of the Telecommunications Act (TCA, SR 784.10), in force since 1 April 2007. Article 45c says that processing data on someone else's device by means of telecommunications techniques is only permitted for telecommunications services and billing, or if users are informed about the processing and its purpose and told that they may refuse it.
The Federal Data Protection and Information Commissioner (FDPIC, known in German as EDÖB) published detailed guidelines on cookies and similar technologies on 22 January 2025, with additions on 6 October 2025. They are the main reference for how the two texts apply to websites and apps.
Territorial scope
Article 3 FADP applies the Act to circumstances that have an effect in Switzerland, even if they were initiated abroad. A German, French or American website that tracks visitors in Switzerland falls within its scope for that tracking.
Who does the nFADP apply to?
The rules concern anyone who decides why and how cookies are used on a website or app:
- Swiss companies and organisations of every size, from a local shop to a large retailer.
- Foreign businesses that target Swiss visitors or whose tracking affects them, under article 3 FADP.
- Federal bodies, which face stricter rules: the FDPIC notes that they need express consent even for ordinary profiling.
The FDPIC is clear that the website owner is responsible for cookie usage, because it decides which data is processed via its site and for what purpose. When you embed third-party services such as social plug-ins, videos or ad tags that collect data for their own purposes, the FDPIC considers that you share responsibility for that collection. You cannot simply point to the third party's terms of use.
Foreign private controllers may also need a representative in Switzerland (article 14 FADP) if their processing of Swiss residents' data is linked to offering goods or services or to monitoring behaviour, and is large scale, regular and high risk.
What the nFADP requires for cookies and consent
Two layers: article 45c TCA and the FADP
Swiss cookie law is built in two layers. Article 45c TCA covers the technical act of setting and reading cookies on a device, whether or not personal data is involved, and always requires information plus a right to refuse. The FADP then governs the processing of any personal data the cookies collect.
The FDPIC sorts cookies into three groups.
Technically necessary cookies
Cookies that are needed for the site to work, or for its security, are proportionate under the FADP. The FDPIC's non-binding examples include:
- a shopping basket cookie;
- temporary storage of form input;
- authentication of a logged-in user;
- storage of the chosen language;
- storage of the visitor's cookie choice itself;
- load balancing, protection against brute-force login attempts, and captchas.
Necessity applies to content, storage duration and disclosure. A language preference, for example, should be stored as a simple value like "language: de", without a unique user ID.
Non-essential cookies: justification and a mandatory opt-out
Functional, analytics and advertising cookies go beyond what is necessary, so the FDPIC says they conflict with the proportionality principle in article 6 FADP. Under articles 30 and 31 FADP, processing that breaches this principle is unlawful unless it is justified by consent, an overriding private or public interest, or the law.
In practice you have two routes:
- Overriding interest plus opt-out. You weigh your interest against the intrusion. Giving visitors a way to refuse reduces the intrusion, and for non-essential cookies that opt-out is mandatory anyway under article 45c TCA.
- Consent. Valid consent under article 6(6) FADP must be voluntary, specific and based on appropriate information.
Visitor statistics deserve a mention. The FDPIC says analytics can be justified by an overriding interest when data is anonymised as soon as possible (on websites, usually immediately), and results are published without identifying anyone. This also works with external tools, provided the provider processes data only on your behalf.
When opt-in becomes mandatory
Article 6(7) FADP requires express consent for processing sensitive personal data and for high-risk profiling by a private person. The FDPIC applies this to cookies: where tracking enables an assessment of essential aspects of someone's personality, an opt-out is no longer enough. It warns that cross-site advertising tracking can exceed the threshold of ordinary profiling, and that if you have not analysed the risk, you must assume it is high. Unexpected uses of cookies, for instance commercial tracking on a political, trade union or religious website, also call for prominent notices or express consent.
Information, defaults, withdrawal and proof
Article 19 FADP requires you to tell visitors at least who you are, why you process their data and to whom you disclose it, including any foreign countries. The FDPIC asks for a layered approach, with the key information on the first level, and stresses that a privacy policy hidden in a corner of the site is not enough.
Article 7(3) FADP requires privacy-friendly default settings. The FDPIC reads this as limiting cookie use to the minimum until visitors have actually been able to read the information and use the refuse button.
Consent and rejection must be revocable at any time, without formalities. Making withdrawal much harder than giving consent breaks the voluntariness requirement. Once a visitor has opted in, the FDPIC expects a visible notice on later visits reminding them they can withdraw, with simple navigation to do so. If you rely on consent, keep records showing what visitors were told and what they chose, so you can demonstrate it was informed and voluntary.
An nFADP-compliant cookie banner
The FDPIC describes cookie banners and consent management platforms as the common way to meet these duties. A Swiss-ready banner should:
- explain the purposes of each cookie category and name the third parties involved;
- let visitors accept or refuse categories individually where purposes differ;
- make it obvious which items are mandatory and which are optional;
- for opt-out cookies, show visitors on their first and later visits how to refuse with just a few clicks;
- for opt-in cases, require an active click or tick before anything runs;
- keep a permanent way to change the choice later.
The FDPIC recommends a two-click solution for social plug-ins, tracking pixels and other third-party services, so their JavaScript only loads after the visitor has been informed and has agreed.
Prohibited dark patterns
The guidelines state that misleading designs and wording (dark patterns or nudging) can make consent invalid. They specifically flag:
- a dialog that only lets users accept everything or leave the site, which is not a clear declaration of consent;
- pre-ticked boxes that are harder to untick than to tick;
- fonts, images or colours that cause confusion when visitors make their choice;
- forcing visitors to deselect a long list of items to withdraw, which the FDPIC calls an unlawful dark pattern;
- cookie paywalls where the price is disproportionate to the revenue the operator would lose.
For practical layouts, see our guide to a GDPR-compliant cookie banner and the overview of cookie dark patterns regulators prohibit.
Penalties and enforcement
The FDPIC supervises the application of federal data protection law. It does not impose fines, but under article 51 FADP it can order that processing be modified, suspended or terminated and that data be deleted, and it can require companies to inform data subjects properly.
Fines are criminal penalties. Under articles 60 to 63 FADP, private persons who wilfully breach certain duties, such as the duty to inform under article 19, the rules on disclosure abroad, or an FDPIC ruling, face fines of up to CHF 250,000. Several of these offences are prosecuted only on complaint, and prosecution is a matter for the cantons (article 65). Where identifying the responsible individual would be disproportionate and the fine would not exceed CHF 50,000, the business can be ordered to pay instead (article 64). Separately, a breach of article 45c TCA can be fined up to CHF 5,000 under article 53 TCA, as the FDPIC guidelines point out.
Real cases
- Ricardo AG and TX Group AG. The FDPIC concluded an investigation into the Ricardo auction platform on 11 April 2024. It recommended that the companies make data transfers and cross-platform tracking for targeted advertising transparent and obtain valid consent from users. The FDPIC's cookie guidelines note that this case concerned cookies linking usage data across companies in the same group, and was decided under the old FADP. (FDPIC press release)
- Digitec Galaxus AG. In an investigation concluded in April 2024 under the old law, the FDPIC found that tying orders to a mandatory customer account breached proportionality and recommended letting customers object to marketing processing. On 27 November 2025 the retailer reported that users can now disable personalisation in one click, which automatically disables the related cookies, and the FDPIC closed the case. (FDPIC case page)
Compliance checklist
- List every cookie, pixel and embedded service on your site, including third-party tools.
- Separate technically necessary cookies from the rest, using the FDPIC examples as a guide.
- Inform visitors on the first layer about purposes, recipients and foreign transfers, with a link to full details.
- Offer a clear, easy way to refuse every non-essential cookie, visible on the first and later visits.
- Identify high-risk tracking (cross-site advertising profiles, sensitive contexts) and switch it to express opt-in.
- Block third-party scripts until visitors have been informed and, where needed, have agreed.
- Avoid dark patterns: no accept-or-leave dialogs, no hard-to-untick boxes, no confusing colours.
- Make withdrawal simple through a permanent link or icon.
- Anonymise analytics where you rely on the statistics justification.
- Check whether you need a Swiss representative if you are based abroad.
How FlowConsent helps you comply with the nFADP
FlowConsent handles the technical side of the Swiss rules. Scripts are blocked before consent, so third-party tags stay off until visitors have seen the information and made their choice, which also covers Swiss opt-in cases. The automatic scan lists the cookies and services on your site, the starting point for separating necessary cookies from the rest (see how to publish your cookie declaration). Each choice is recorded and you can export proof of consent whenever you need it. Google Consent Mode v2 is built in, hosting is in Europe and setup takes about ten minutes. Start with our free scanner to see what your site loads today, then sign up: FlowConsent is free up to 25,000 sessions per month, and Pro costs €14.99 per month for up to 100,000 sessions.
Further reading
The articles below cover the practical side of these rules. Our guide to cookieless analytics is useful if you want to rely on the Swiss statistics justification, and the article on cookie walls explains why accept-or-leave designs are risky in Switzerland as well as in the EU.