The FADP and website statistics

The AlpiStats team · Published 16 October 2026 · Updated 17 October 2026

Short answer: as soon as your statistics tool processes IP addresses, cookie identifiers or browser "fingerprints", it processes personal data and the FADP applies. You must then: collect the minimum necessary, inform visitors in your privacy policy, sign a data processing contract with the provider, put a framework around any transfer abroad and ensure data security. The closer your statistics are to anonymity, the lighter these obligations become.

Sources last checked: 16 October 2026. Text updated on 17 October 2026 (AlpiStats' approach). This article is for information only; it does not replace legal advice.

The FADP in two sentences

The revised Federal Act on Data Protection (FADP, often called "revFADP") has been in force since 1 September 2023. It applies to companies and individuals who process data about natural persons, including when the processing takes place abroad but has effects in Switzerland.

For a website, the question is therefore not "does the FADP apply?", but "does my statistics tool process personal data, and which?".

Are visit statistics personal data?

Personal data is information relating to an identified or identifiable person (Art. 5 FADP). The figure "1,240 visits in September" is not. But to produce that figure, most tools handle data that often is:

Data	Status as a general rule
Full IP address	Personal data as soon as the operator or a third party can reasonably trace it back to the person. As a precaution, treat it as such.
Persistent cookie identifier (e.g. `_ga`)	Personal data: it recognises the same browser from one visit to the next.
Browser fingerprint (fingerprinting)	Personal data, and a technique regarded as intrusive.
Visited URLs containing an email address, a name or a customer number	Personal data, often collected without the operator realising it.
Aggregated counters (page views, country, device type) with no identifier	In principle anonymous.

The deciding criterion is the possibility of re-identifying a person, taking into account the means reasonably available. Data that is merely pseudonymised (an IP replaced by a constant code, for example) remains personal data. Data that is genuinely anonymised falls outside the scope of the law.

The seven obligations to check

1. Proportionality: collect only what is useful

The processing must be necessary for the purpose pursued (Art. 6 FADP). If you need to know which pages are read and where visitors come from, tracking each person over two years is not necessary. The FDPIC cookie guide puts it this way: if an anonymised analysis achieves the same objective, that is the one to choose.

2. Data protection by default

Article 7 FADP requires default settings that are as privacy-friendly as possible. For statistics: IP anonymisation enabled, short retention, no advertising or data-combining feature enabled without reason.

3. Transparency: the privacy policy

The duty to inform (Art. 19 FADP) requires at least the following to be stated:

the identity and contact details of the person responsible for the site;
the purpose of the processing (here: audience measurement);
the recipients or categories of recipients (the tool provider);
if data leaves the country: the country and the safeguard used.

An intentional breach of this duty is punishable by a fine of up to CHF 250,000 for the individual responsible (Art. 60 FADP).

4. Processing by a processor: a contract with the provider

The statistics tool provider is generally a processor: it processes data on your behalf (Art. 9 FADP). You must have a contract (often called a DPA, Data Processing Agreement) and make sure it guarantees data security. Entrusting data to a processor without meeting these conditions is also a criminal offence (Art. 61 FADP).

Be careful: if the provider also uses the data for its own purposes (improving its advertising products, for example), it is no longer a mere processor, and your information must reflect that.

5. Transfers abroad

If data is stored or accessible outside Switzerland, the disclosure must rest on a legal basis: a country recognised as adequate by the Federal Council (EU states are among them, as are US companies certified under the Swiss-U.S. Data Privacy Framework since 15 September 2024), or safeguards such as standard contractual clauses (Art. 16 and 17 FADP).

Hosting in Switzerland, with a Swiss provider, removes this question.

6. Data security

Data must be protected against loss, unauthorised access and alteration (Art. 8 FADP): encrypted exchanges, access management, backups. Security breaches presenting a high risk must be reported to the FDPIC (Art. 24 FADP).

7. Record of processing activities

Every company must in principle keep a record of its processing activities (Art. 12 FADP). Companies with fewer than 250 employees are exempt, unless they process sensitive data on a large scale or carry out high-risk profiling (Art. 24 of the Data Protection Ordinance). Standard audience measurement does not fall under these exceptions.

The special case of cookies

If your tool places cookies, an additional rule applies on top of the FADP: Article 45c of the Telecommunications Act requires informing visitors and allowing them to refuse. The FDPIC accepts that audience measurement can be justified by an overriding interest of the operator, provided data is anonymised as soon as possible and only non-identifying results are published, but the right to refuse is still owed. The details are in our article Do you need a cookie banner in Switzerland?.

The trap almost nobody sees: URLs

Statistics tools record the address of every page viewed. Yet many URLs contain personal data that nobody intended to include:

…/confirmation?email=marie.dupont@exemple.ch
…/reset-password?token=8f3a…
…/mon-compte?client=104587

This information then ends up in the reports, with the provider, sometimes abroad, and for the whole retention period. It is a frequent flaw after installing a form, a shop or a booking system. Check your page reports, and prefer a tool that cleans URLs before recording them.

FADP checklist for your statistics

I know what data my tool actually collects (IP, cookies, identifiers, full URLs).
The IP is anonymised or not retained.
The retention period is limited to the real need.
Advertising, data-combining and cross-site tracking features are disabled if I do not use them.
My privacy policy names the tool, its purpose, the provider and the hosting country.
I have a data processing contract (DPA) with the provider.
If data leaves Switzerland, I know which safeguard is used.
If the tool places cookies, visitors can easily refuse them.
My URLs contain no email addresses, tokens or customer numbers, or the tool removes them.
If my site also targets the EU, I have checked the European rules (see Swiss website and European visitors).

How to simplify compliance

The closer a tool gets to anonymity, the shorter the list above becomes. A tool with no cookies, which does not retain IP addresses, does not track visitors from one day to the next and hosts data in Switzerland avoids both the cookie question and the question of transfers abroad. What remains is a mention in the privacy policy and a processing contract.

This is the basis of AlpiStats, which goes further than Swiss law: the tool applies the strictest rule to all visitors, in Switzerland as in the EU, and measures audience only after the visitor agrees, in both of its modes. If the visitor refuses, no AlpiStats audience measurement takes place, with no fallback to simpler counting. Essential mode measures audience (pages, origin, device, country) with no persistent audience identifier in the browser; Complete mode adds recognition of returning visitors, using a random identifier, without a cookie, kept in the browser for six months at most, with pseudonymised detailed visits. Visitors can withdraw their agreement at any time through a permanent badge: measurement stops, the identifier is erased and the pseudonymised data linked to them is deleted. The visitor's choice is valid for six months, detailed data is kept for six months at most, and only truly anonymous monthly and daily totals are kept for 25 months. Statistics only cover visitors who have accepted and are not exhaustive. Traffic data is hosted and processed in Switzerland with Infomaniak, URLs are cleaned of email addresses, numbers and tokens before recording, and a data processing contract and the list of sub-processors are public. See how AlpiStats handles visitor data.

Frequently asked questions

Is an IP address personal data in Switzerland?

Most of the time, yes, because it can make it possible to trace back to a person with the help of third parties (the internet service provider). As a precaution, it should be treated as such.

Are anonymous statistics subject to the FADP?

No, genuinely anonymous data is not personal data. But the processing that precedes anonymisation (reading the IP, for example) may itself be subject to the law.

Do I have to mention my statistics tool in my privacy policy?

Yes, as soon as it processes personal data, even briefly. It is also good practice in all cases, for transparency.

Does the FADP apply to a small showcase site?

Yes. The law makes no exception based on the size of the site. Only the record of processing activities is eased for companies with fewer than 250 employees.

Who is responsible if my statistics provider does not comply with the law?

You remain the controller: you choose the tool and decide to use it. Hence the importance of the processing contract and of choosing the provider carefully.