Skip to content

Web analytics in Switzerland: what the revFADP and the Telecommunications Act require

Updated November 3, 2026

Switzerland regulates cookies and audience measurement differently from the EU. Instead of prior consent for every analytics tool, Swiss law mainly asks for transparency and a way to object. This page sums up the situation in November 2026, based on the fact sheet of the Federal Data Protection and Information Commissioner (FDPIC) of 31 March 2026 and its cookie guidelines (January 2025, updated in October 2025). It is general information, not legal advice.

The two legal bases

  • Article 45c of the Telecommunications Act (TCA, FMG in German). Processing data on someone else's device is only allowed if users are informed of the processing and its purpose and told that they can refuse it. That covers cookies, and also similar techniques: pixels, the browser's local storage, device fingerprinting.
  • The revised Federal Act on Data Protection (revFADP), in force since 1 September 2023. It governs the personal data collected that way: the duty to inform, disclosure abroad, the rights of data subjects.

Information and objection, with exceptions

For non-essential cookies, analytics tools included, the FDPIC asks in principle for two things: information about their use and purpose, and a way to refuse (opt-out), in principle before they are activated.

Prior, express consent is needed when the processing counts as "unexpected" or "high risk", or concerns sensitive personal data. The FDPIC names personalised advertising, passing visitor data to third parties for payment, and profiling with location data.

An analytics tool that only collects anonymised navigation data for the site itself, passing nothing to third parties, falls under the first case. Advertising and profiling features rather fall under the second.

What the privacy policy has to say

Under the revFADP you state:

  • who is responsible and how to reach you;
  • which tool you use and why;
  • what data is processed;
  • who receives it, and in which countries;
  • how to object to the processing.

For disclosure abroad, the countries with adequate protection are listed in annex 1 of the Data Protection Ordinance. Germany and the other EU states are on it. The United States has been on it since 15 September 2024, but only for companies certified under the Swiss-US Data Privacy Framework.

Intentional breaches of some revFADP duties, such as the duty to inform, can be fined up to 250,000 francs. The fine falls on the responsible individual, not the company.

Google Analytics in Switzerland

Google LLC is certified under the Swiss-US Data Privacy Framework, so the transfer to the United States has been allowed without additional safeguards since September 2024. For GA4's cookies you need at least information and objection. Once advertising features are added, such as the Google Ads link, consent comes closer, because the FDPIC names personalised advertising among the cases that may require it.

Visitors from the EU

If your site also targets people in the EU, for example a shop that ships to Germany or France, the GDPR can apply (article 3(2) GDPR), and with it the stricter cookie rules of the EU countries. Many Swiss sites therefore follow the European standard and show a banner, as the FDPIC also notes.

For visitors from France, the CNIL's exemption for audience measurement without consent then applies, under strict conditions (see The CNIL consent exemption: the July 2025 criteria explained). For visitors from Germany it is § 25 TDDDG, and the German authorities judge each setup case by case.

Which tool fits?

  • If you require hosting in Switzerland: choose a Swiss provider. Statsdot stores the data on servers in Germany, and requests pass through Cloudflare, a US company.
  • If you want little data and no cookie: a tool without cookies and without passing data to third parties falls under the information-and-objection rule in Switzerland. Statsdot sets no cookies, stores no IP addresses and provides an opt-out button for the privacy policy that excludes the visitor from measurement.
  • If you have many visitors from the EU: for France, the CNIL exemption mode helps. For Germany, check the setup with your adviser.

Statsdot is priced in euros, with a 30-day trial without a card. To see which trackers and cookies your home page loads today, run it through our free site check.