Do you need a cookie banner in Switzerland?
The AlpiStats team · Published · Updated
Short answer: Swiss law does not necessarily require a consent banner. Switzerland applies an opt-out system in principle: for non-essential cookies, you must inform visitors and allow them to refuse, visibly from the first visit (Art. 45c TCA). Prior consent (opt-in) is mandatory only in certain cases: sensitive data, high-risk profiling, political or religious content, federal bodies, and visitors from the European Union. A site with no non-essential cookies is not required to show a banner under the TCA, but must still have a privacy policy. Nothing prevents you from applying the strictest rule everywhere, that is, prior consent for all visitors: this is AlpiStats' choice.
Sources last checked: 16 October 2026. Text updated on 17 October 2026 (AlpiStats' approach). This article is for information only; it does not replace legal advice.
What Swiss law says
Two texts apply at the same time:
- Article 45c of the Telecommunications Act (TCA) covers any processing of data on another person's device, such as placing or reading a cookie. It requires informing the user, stating the purpose and allowing the user to refuse. Failure to comply is punishable by a fine.
- The revised Federal Act on Data Protection (FADP), in force since 1 September 2023, applies as soon as cookies are used to process personal data, which is almost always the case.
In January 2025, the Federal Data Protection and Information Commissioner (FDPIC) published a guide on cookies and similar technologies, updated on 6 October 2025. It does not create new obligations, but it shows how the supervisory authority reads the law. It is now the practical reference in Switzerland.
The table to remember
| Type of cookie or processing | What to do in Switzerland |
|---|---|
| Technically necessary cookies (shopping cart, login, language, remembering the cookie choice, security, load balancing) | No consent. Limit them to what is strictly necessary and mention them in the privacy policy. |
| Convenience functional cookies, audience measurement, advertising with "ordinary" profiling | Information + right to refuse (opt-out), visible from the first visit and easy to exercise. |
| High-risk profiling (combining data to assess essential aspects of a person's personality) | Explicit consent (opt-in) before any cookie is placed. |
| Sensitive data (health, religion, political opinions, etc.) or political, trade-union or religious content | Explicit consent (opt-in). |
| Websites of federal bodies | Explicit consent even for ordinary profiling. |
| Visitors located in the European Union | Prior consent (opt-in) for any non-essential cookie, audience measurement included (subject to strict national exemptions). |
Summary based on the FDPIC guide (sections 3.5 to 3.13 and Annex A).
An important point: the FDPIC asks that a high risk be presumed as long as the operator cannot rule it out. In practice, advertising tools that follow visitors from one site to another or combine several data sources must be treated with caution, with an opt-in.
Does audience measurement need consent?
In Switzerland, in principle no, but it is not unrestricted either.
The FDPIC guide accepts that analysing site traffic can be justified by an overriding interest of the operator, on three conditions: anonymise the data as soon as the purpose allows, pass on to third parties only data that does not make it possible to identify individuals, and publish the results in a non-identifying form. If an anonymised analysis achieves the same goal, it must be preferred.
Even then, the right to refuse under Art. 45c TCA remains mandatory as soon as the tool places cookies. That is why most Swiss sites using Google Analytics display at least an information banner with a refuse button.
A cookieless statistics tool that reads nothing on the visitor's device does not fall under the cookie mechanism of Art. 45c TCA. The FADP continues to apply if it processes personal data (even briefly, such as an IP address): it must then be mentioned in the privacy policy. See The FADP and website statistics. This describes Swiss law; any tool is free to require more, as AlpiStats does (see below).
What should a banner that meets the requirements look like?
The FDPIC guide gives precise indications. Depending on the case:
For a simple opt-out (the most common case in Switzerland)
- Clear information on the cookies used and their purposes, available from the first visit and on later ones.
- A way to refuse that can be exercised in a few clicks, without a discouraging journey.
- A refusal that genuinely blocks the cookies concerned (test it!).
- A link to the privacy policy.
A discreet banner at the bottom of the page is generally enough. The FDPIC recommends a more visible window (pop-up) for higher-intensity processing.
For an opt-in (explicit consent)
- No cookie subject to consent before the user acts: the blocking must be technical, not just displayed.
- A positive act: a clear click. Silence or continued browsing does not amount to consent.
- A choice per purpose: the FDPIC considers that a window offering only "accept all" or "refuse all" does not give a sufficiently clear expression of will.
- No pre-ticked boxes that are hard to untick: deselecting must not be more complicated than selecting.
- No manipulation (dark patterns, nudging): a "refuse" button that is hidden, greyed out or buried in a submenu can make the consent void.
- Withdrawal as easy as giving consent: a permanent link (for example in the footer) to change one's choice.
The most common mistakes on Swiss sites
- Copying a European banner without adapting it. It is often more restrictive than Swiss law requires, which loses data. That is a possible choice (see below), as long as you make it knowingly.
- Displaying a banner that blocks nothing. Cookies are placed as soon as the page loads, whatever the choice. This is the most frequent flaw, and the easiest to spot.
- Forgetting the privacy policy. The banner does not replace it: the FADP requires complete information (identity of the controller, purposes, recipients, foreign countries concerned).
- Ignoring European visitors. A site that sells or communicates towards France, Germany or Italy must apply EU rules to those visitors.
- Never reviewing the list of cookies. A new plugin, an embedded video or an advertising pixel adds cookies without anyone noticing.
Can you dispense with any banner?
From the standpoint of the TCA alone, yes: if your site uses only technically necessary cookies, or none at all, the law requires neither specific information nor a right to refuse under Art. 45c. This is the case for a showcase site that:
- uses no audience measurement tool that places cookies;
- includes neither an advertising pixel nor a social network button that places third-party cookies;
- embeds videos in "two-click" mode or in cookieless mode.
A privacy policy is still required in all cases (FADP). And as soon as you want to measure your audience, the question of consent comes back, depending on the tool and the audience you target: Swiss law sets a minimum, the EU requires prior consent, and a tool can decide to apply the strictest rule everywhere.
That is the choice of AlpiStats, the Swiss statistics tool: it applies the strictest rule to all visitors, in Switzerland as in the EU, and measures audience only after the visitor agrees, in both of its modes. The AlpiStats banner offers two identical buttons, "Accept" and "Refuse", and a permanent badge lets visitors change their mind; a site that already has its own banner can link it to AlpiStats. If the visitor refuses, no AlpiStats audience measurement takes place, with no fallback to simpler counting. Essential mode measures audience (pages, origin, device, country) with no persistent audience identifier in the browser. Complete mode adds recognition of returning visitors, using a random identifier, without a cookie, kept in the browser for six months at most; detailed visits are then pseudonymised. Withdrawing consent through the badge stops measurement, erases the identifier and deletes the pseudonymised data linked to the visitor. The trade-off is accepted: statistics only cover visitors who have accepted; they are not exhaustive. The visitor's choice is valid for six months; detailed data is kept for six months at most, and only truly anonymous monthly and daily totals are kept for 25 months. Traffic data is hosted and processed in Switzerland. Learn more about cookieless statistics.
Frequently asked questions
Is a cookie banner mandatory in Switzerland?
No, not as such. What is mandatory is to inform visitors and allow them to refuse non-essential cookies. A banner is simply the most common way to do so.
Is Switzerland opt-in or opt-out?
Opt-out for most cookies. Opt-in is required for sensitive data, high-risk profiling, certain content and federal bodies.
Does the banner need a "Refuse" button?
For opt-out, you need a simple, visible way to refuse; a button is the clearest solution. For opt-in, refusing must be as easy as accepting.
Are Google Analytics cookies "necessary"?
No. They are audience measurement cookies. In Switzerland, they require at least information and a right to refuse.
What fine applies for non-compliance?
Art. 45c TCA carries a fine. The FADP also provides for fines of up to CHF 250,000 against the individuals responsible, in particular for intentional breach of the duty to provide information.