AlpiStats
Sign inFree trial
Blog

Is Google Analytics legal in Switzerland?

The AlpiStats team · Published · Updated

Short answer: yes. No Swiss law prohibits Google Analytics. Since 15 September 2024, data can be transferred to US companies certified under the Swiss-U.S. Data Privacy Framework, which Google relies on. But using it lawfully requires three things: informing visitors (privacy policy), allowing them to refuse measurement cookies (Art. 45c TCA), and obtaining their prior consent if your site also targets visitors in the European Union. The transfer framework also remains fragile.

Sources last checked: 16 October 2026. Text updated on 17 October 2026 (AlpiStats' approach). This article is for information only; it does not replace legal advice.

Why the question arises

Google Analytics (GA4) places cookies in the visitor's browser and sends browsing data to Google LLC, a US company. In Switzerland, this involves three different sets of rules:

  1. The revised Federal Act on Data Protection (FADP, commonly called "revFADP"), in force since 1 September 2023: it governs any processing of personal data, including cookie identifiers and IP addresses.
  2. Article 45c of the Telecommunications Act (TCA): it specifically governs storing or reading information on another person's device, and therefore cookies.
  3. The rules on disclosing data abroad (Art. 16 and 17 FADP): they apply as soon as data leaves Switzerland.

Between 2020 and 2022, several European authorities (Austria, France and Italy in particular) ruled the use of Google Analytics unlawful because of insufficient protection in the United States. These decisions were widely reported in Switzerland and still feed the idea that "Google Analytics is banned". That is not the case under Swiss law, and the situation has changed since.

Transfers to the United States are possible again

On 14 August 2024, the Federal Council added the United States to the list of states offering an adequate level of protection, for certified companies only, under the Swiss-U.S. Data Privacy Framework (DPF). The amendment to the Data Protection Ordinance entered into force on 15 September 2024. Since then, these transfers no longer require additional safeguards.

Google states that it relies on this framework, since 16 September 2024 and "in certain circumstances", for transfers of data from Switzerland to the United States relating to its advertising and measurement products. For other cases, Google refers to the standard contractual clauses.

What this means in practice: the transfer itself is no longer the main obstacle. It must nevertheless be mentioned in your privacy policy, together with the destination country and the safeguard used (Art. 19 FADP).

A framework that remains fragile

The two previous agreements between Europe and the United States (Safe Harbor in 2015, Privacy Shield in 2020) were invalidated by the Court of Justice of the EU, and Switzerland followed each time. The current framework has survived a first challenge: the General Court of the EU upheld it on 3 September 2025 (Latombe case). An appeal was lodged before the Court of Justice on 31 October 2025; to our knowledge, it is still pending in October 2026.

The Swiss framework is legally separate from the EU framework, but it mirrors it. If the Court of Justice annulled the EU framework, a challenge on the Swiss side would be likely. A site that relies entirely on Google Analytics therefore carries a risk of disruption, not just a legal risk.

Cookies: in Switzerland, information and the right to refuse are mandatory

Article 45c TCA requires that, for non-essential cookies, the visitor be informed of their use and purpose, and told that they can refuse. The Federal Data Protection and Information Commissioner (FDPIC) clarified these rules in a cookie guide published in January 2025 and updated on 6 October 2025.

What this means for Google Analytics:

  • Audience measurement can be justified by an overriding interest of the site operator, provided in particular that data is anonymised as soon as possible and that the results do not make it possible to identify individuals (FDPIC guide, section 3.8.2).
  • But it never removes the right to refuse provided for by Art. 45c TCA. This right must be visible from the first visit and exercisable in a few clicks.
  • Explicit consent (opt-in) becomes necessary if the processing amounts to high-risk profiling or involves sensitive data. The FDPIC asks that this risk be presumed as long as it cannot be ruled out. Enabling Google Signals, linking GA4 to Google Ads or combining the data with other sources can tip you into this category.

👉 The details are explained in our article Do you need a cookie banner in Switzerland?.

What GA4 does with IP addresses

According to Google's documentation, for visitors located in the EU, Switzerland or the United Kingdom, GA4 collects data through servers located in Europe. The IP address is used there to infer an approximate location (country, region, city), then it is deleted: it is neither logged nor stored. The data is then forwarded to Analytics servers for processing, without Google specifying where they are located.

This is real progress compared with the previous version (Universal Analytics). It is not enough to make the data anonymous: GA4 still uses a cookie identifier that recognises the same browser from one visit to the next, which remains personal data within the meaning of the FADP.

Who is responsible, and what is at stake?

The site operator is responsible, not Google. The FDPIC is clear on this: it is the site owner who decides to integrate the tool, and they cannot shift responsibility onto the provider's terms of use.

The FADP provides for criminal penalties directed at individuals (managers, officers), not at the company itself:

  • a fine of up to CHF 250,000 for intentional breach of the duty to provide information (Art. 60 FADP);
  • the same maximum fine for certain breaches of the duty of care, including a disclosure of data abroad that does not comply with the law (Art. 61 FADP).

These offences are prosecuted on complaint and judged by the cantonal criminal authorities. In practice, the most common risk for an SME is not the fine, but a complaint from a visitor, an FDPIC investigation or a requirement from a client (public tender, large account, healthcare or finance sector) asking for guarantees.

Checklist: using Google Analytics in compliance in Switzerland

  1. Privacy policy: name Google as a recipient, state the United States as the destination country and the Swiss-U.S. DPF as the safeguard, and describe the purposes and the retention period.
  2. Right to refuse: a link or banner visible from the first visit, which genuinely blocks GA4 once the visitor has refused.
  3. GA4 settings: disable Google Signals if you do not need it, limit granular location and device data for Switzerland, reduce the data retention period to the minimum useful, and disable data sharing with Google if possible.
  4. Processing contract: accept Google's data processing terms (Google Ads Data Processing Terms) in the admin interface.
  5. No personal data in URLs: email addresses, customer numbers or tokens in URL parameters end up in the reports.
  6. EU visitors: if your site also targets them, put prior consent (opt-in) in place before loading GA4. See Swiss website and European visitors: FADP or GDPR?.
  7. Plan B: know how you would measure your audience if the transfer framework fell.

When to consider an alternative

Google Analytics remains a very complete tool, and free in its standard version. An alternative makes sense if:

  • you mainly use the basic figures (visits, page views, sources, countries, devices);
  • you want simpler consent management and less dependence on the transfer framework;
  • your clients or your sector require data hosted in Switzerland;
  • you find the GA4 interface too complex for what you use it for.

Measurement tools hosted in Switzerland meet these needs, provided you accept their rules. AlpiStats, for example, stores data in Switzerland with Infomaniak and applies the strictest rule to all visitors, in Switzerland as in the EU: it measures audience only after the visitor agrees, in both of its modes, and carries out no measurement if the visitor refuses. Essential mode measures audience (pages, origin, device, country) with no persistent audience identifier in the browser; Complete mode adds recognition of returning visitors, using a random identifier, without a cookie, kept for six months at most, with pseudonymised detailed visits. Visitors can withdraw their agreement at any time through a permanent badge. The trade-off is accepted: statistics only cover visitors who have accepted, so expect lower figures than from a tool that counts without waiting for agreement. It can run alongside Google Analytics during a transition period, which lets you compare. Compare AlpiStats and Google Analytics.

Frequently asked questions

Is Google Analytics banned in Switzerland?

No. No Swiss decision prohibits it. The prohibition decisions often cited come from European authorities and date from 2022, before the Data Privacy Framework.

As a rule, no: information and the possibility to refuse are enough. Explicit consent becomes necessary in cases of high-risk profiling or sensitive data, and it is required for EU visitors.

Is GA4's IP anonymisation enough?

It reduces the risks but does not make the data anonymous, because GA4 recognises browsers from one visit to the next through its cookies.

What happens if the Data Privacy Framework is annulled?

Transfers to Google would again have to rely on other safeguards (standard contractual clauses and a risk assessment), as between 2020 and 2024. Affected sites would need to review their compliance quickly.

Can a public authority use Google Analytics?

The FDPIC requires federal bodies to obtain explicit consent even for ordinary profiling. Cantonal and municipal authorities are subject to cantonal law, which is often stricter; they must check with their cantonal data protection commissioner.

Sources

Try AlpiStats on your website

30 days free, no card required. Basic installation in a few minutes if you have access to your site.

Create an account