Swiss website and EU visitors: FADP, GDPR, or both?
The AlpiStats team · Published · Updated
Short answer: often both. A Swiss company remains subject to the FADP, but the GDPR also applies to it if it offers goods or services to people in the EU, or if it monitors their behaviour online (Art. 3(2) GDPR). For these visitors, European cookie rules in principle require prior consent for any non-essential cookie, audience measurement included, whereas Switzerland settles for a right to refuse. The simplest solution: apply the European rules to all visitors, with your own banner or with a tool that does so from the outset (at the price of statistics limited to visitors who accept).
Sources last checked: 16 October 2026. Text updated on 17 October 2026 (AlpiStats' approach). This article is for information only; it does not replace legal advice.
When does the GDPR apply to a Swiss company?
The General Data Protection Regulation (GDPR) applies first of all to organisations established in the EU. A company with no establishment in the EU is also subject to it in two cases (Art. 3(2) GDPR):
- It offers goods or services to people who are in the EU, whether or not for payment.
- It monitors the behaviour of those people, insofar as that behaviour takes place in the EU.
The targeted-offer criterion
The mere fact that your site is accessible from Lyon or Munich is not enough. What matters, according to the guidelines of the European Data Protection Board (EDPB), is the intention to target people in the EU. Typical indicators:
- prices displayed in euros, delivery or service in an EU country;
- language version or domain name intended for an EU country (
.fr,.de); - advertising campaigns targeting EU countries;
- mention of customers or telephone numbers in the EU.
An SME from the canton of Vaud that delivers to France, a hotel in the Valais that advertises in Germany or a Geneva software publisher that sells in euros are typically concerned. A craftsperson who works only in French-speaking Switzerland, generally not.
The behaviour-monitoring criterion
The EDPB considers that tracking a person online, in particular by cookies or similar techniques, to analyse or predict their behaviour, can constitute "behaviour monitoring". Advertising and profiling tools are clearly targeted. For simple aggregated audience measurement, the question is more debated, but the risk is not zero as soon as the tool recognises visitors from one visit to the next.
What this changes in practice
1. Cookies: prior consent for EU visitors
In the EU, cookies fall under the "ePrivacy" directive, transposed in each country (in France, Article 82 of the Data Protection Act, loi Informatique et Libertés). General rule: any non-essential cookie requires prior consent, given by a positive act, with refusal as easy as acceptance.
Audience measurement is not exempt from this rule, apart from narrow national exemptions. The CNIL, for example, exempts from consent audience measurement tools that meet strict conditions: purpose limited to measuring the site itself, data used only to produce anonymous statistics, no cross-referencing with other processing, no tracking on other sites, and limited lifetime of trackers and retention period. Google Analytics, in its standard configuration, does not meet these conditions.
| Visitors in Switzerland | Visitors in the EU | |
|---|---|---|
| Technically necessary cookies | No consent | No consent |
| Audience measurement with cookies | Information + right to refuse | Prior consent (unless a strict national exemption applies) |
| Advertising, profiling | Opt-out or opt-in depending on the risk | Prior consent |
| Tool with no cookies and no access to the device | Information in the privacy policy | No cookie rule; the GDPR applies if personal data is involved |
2. The privacy policy
The GDPR requires more detailed information than the FADP, in particular the legal basis for each processing activity (consent, legitimate interest, contract, etc.) and the retention period. A policy written to satisfy the GDPR generally covers the FADP as well; the reverse is not true.
3. A representative in the EU
A Swiss company subject to the GDPR under Article 3(2) must in principle designate a representative established in the EU (Art. 27 GDPR). An exception exists for occasional processing that does not involve large-scale processing of sensitive data and does not present a risk to individuals. Many Swiss SMEs are unaware of this obligation.
4. Data transfers to Switzerland
Good news: the European Commission recognises Switzerland as a country offering an adequate level of protection, and confirmed this decision in January 2024. Data of European visitors can therefore be hosted in Switzerland without additional safeguards.
Three ways to organise
Option 1: a different banner depending on the visitor's country.
Consent management platforms (CMPs) can display an opt-out in Switzerland and an opt-in in the EU. This is the solution that preserves the most data, but it is more complex to configure and test, and geolocation is not always reliable (VPNs, cross-border commuters).
Option 2: apply the European rules to everyone.
A single opt-in banner for all visitors. Simple and cautious, but you lose part of the statistics of your Swiss visitors, who did not need to consent.
Option 3: choose a tool that applies the strictest rule to everyone from the outset.
A measurement tool that asks every visitor for agreement before any measurement, whatever their country, saves you from running two regimes or guessing where visitors are located, and leaves you a single way of working to describe in your privacy policy. The drawback is accepted: statistics only cover visitors who accept, and are never exhaustive. Combine it with videos in "two-click" mode and no advertising pixels on regular pages.
What could change on the EU side
In November 2025, the European Commission proposed, in a package called the Digital Omnibus, to integrate the cookie rules into the GDPR. The text notably provides for a consent exemption for aggregated audience measurement, carried out by the operator for its own service and for internal use. Tools that track visitors across several services or clients would remain subject to consent. This is a proposal, still under negotiation: nothing changes until it is adopted and enters into application.
How AlpiStats handles this case
AlpiStats, the Swiss statistics tool, applies the strictest rule to all visitors, in Switzerland as in the EU: no difference in treatment depending on the country, no geographic detection. Audience measurement takes place only after the visitor agrees, in both of its modes, using the AlpiStats banner (identical "Accept" and "Refuse" buttons, permanent badge to change one's mind) or your own banner linked to AlpiStats. If the visitor refuses, no AlpiStats audience measurement takes place, and there is no fallback to simpler counting. Essential mode measures audience (pages, origin, device, country) with no persistent audience identifier in the browser. Complete mode adds recognition of returning visitors, using a random identifier, without a cookie, kept in the browser for six months at most; detailed visits are then pseudonymised. Visitors can withdraw their agreement at any time through the badge: measurement stops, the identifier is erased and the pseudonymised data linked to them is deleted. Statistics only cover visitors who have accepted and are not exhaustive. Traffic data is hosted and processed in Switzerland. Discover AlpiStats.
Frequently asked questions
My company is in Switzerland: can the GDPR really apply to me?
Yes, if you target people in the EU (offering goods or services) or monitor their behaviour online. The company's location is not enough to rule it out.
Is it enough to have a few French visitors to be subject to the GDPR?
No. Occasional visits to a site that does not target the EU are not enough. What matters is the intention to address people in the EU.
Do European visitors need to consent for Google Analytics?
Yes, as a rule: its cookies are not essential and its standard configuration does not meet the conditions of the national exemptions.
Can I host European visitors' data in Switzerland?
Yes. The EU recognises Switzerland as an adequate country; no additional transfer mechanism is needed.
Which law is stricter?
For cookies and the information given to individuals, the GDPR and the ePrivacy rules are more demanding than Swiss law. Complying with the GDPR generally also covers the FADP on these points.
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 3 and 27
- EDPB, Guidelines 3/2018 on the territorial scope of the GDPR
- Federal Office of Justice, EU adequacy decision for Switzerland
- CNIL, Consent exemption for audience measurement (example configuration)
- Taylor Wessing, The Digital Omnibus: Cookies
- FDPIC, Guide on data processing using cookies and similar technologies, version 1.1 of 6 October 2025 (French version)
- Federal Act on Data Protection (FADP), SR 235.1