Law · 7 November 2026 · 5 minute read
Website tracking in Switzerland: revDSG and FMG
What applies to cookies and tracking in Switzerland: revDSG since 1.9.2023, Art. 45c FMG, duty to inform under Art. 19 DSG and when the GDPR also applies.
In Switzerland, a different model applies to cookies and tracking than in Germany and Austria. There is no general consent requirement for every script. Instead there are duties to inform and to allow people to decline. In some cases, consent is needed after all. This article classifies the rules and shows when Swiss companies must also observe the GDPR.
Two laws that work together
The Data Protection Act (DSG). The totally revised DSG has been in force since 1 September 2023. It regulates any processing of personal data, including with cookies and similar techniques. The text is on Fedlex.
The Telecommunications Act (FMG). Art. 45c FMG is a special rule for storing and reading on other people's devices and has applied since 2007. According to the guide of the Federal Data Protection and Information Commissioner (FDPIC), website operators must inform visitors about the use of such technologies and their purpose. They must also point out that and how visitors can decline the processing. Both laws apply side by side. You can find the FMG at Fedlex.
What this means in practice
In 2025 the FDPIC published a guide to cookies and similar technologies, in a revised version in October 2025. It is not a source of law, but it shows how the authority reads the laws. Three building blocks follow from it.
- Information. Under Art. 19 DSG you must inform the individuals concerned when you obtain personal data. Name the controller, the purpose and, where applicable, recipients. Where third parties collect data via your site for their own purposes, that must be disclosed too.
- Being able to decline. Where consent is not needed, visitors must be able to object to the use of non-essential cookies. The guide requires that this option be designed prominently and in good faith. In addition, use until then should be limited to the necessary minimum through default settings.
- Consent in certain cases. The FDPIC regards consent as required, for example, for particularly intrusive tracking, such as high-risk profiling. Where it is needed, it must be explicit.
A balancing of interests is structured differently in Swiss law than in the GDPR. The DSG does not require a legal basis for every processing operation by private controllers. Only if a processing operation violates personality rights is a ground of justification needed, such as consent or an overriding interest (Art. 30 and 31 DSG).
Switzerland, Germany and Austria compared
| Switzerland | Germany | Austria | |
|---|---|---|---|
| Rule for the end device | Art. 45c FMG | § 25 TDDDG | § 165 para. 3 TKG 2021 |
| Basic model | Information and option to decline | Consent | Consent |
| Consent needed? | Only in certain cases | In principle | In principle |
| General data protection rule | DSG | GDPR | GDPR |
The rules for the two neighbouring countries are explained in § 25 TDDDG: cookies and tracking in Germany and Cookies in Austria: § 165 TKG 2021 explained.
When EU law applies anyway
A Swiss company can also be subject to the GDPR. Art. 3(2) GDPR covers controllers without an establishment in the EU if the processing relates to
- offering goods or services to data subjects in the Union, or
- monitoring their behaviour as far as it takes place in the Union.
This is called the place-of-market principle. A web shop from Zurich that deliberately delivers to Germany or Austria offers goods in the Union. A purely Swiss site not aimed at EU users is less likely to meet the condition, but that is a question for the individual case. Whether currency, language, shipping countries and advertising target the EU are typical indicators.
Whether the cookie rules of an EU country also apply alongside depends on the individual case. Clarify this with your data protection adviser if your offer is aimed specifically at the EU.
Checklist for Swiss websites
- Record all scripts and purposes on your site.
- Inform in the privacy policy under Art. 19 DSG, including about third parties.
- Show a clearly visible notice with an option to decline.
- Obtain explicit consent if you carry out high-risk profiling.
- Check whether you direct offers at people in the EU. The GDPR then applies in addition.
Frequently asked questions
Do I need no cookie banner in Switzerland? There is no blanket duty for a consent banner. You must, however, inform and make declining possible. In practice that is often done via a banner. For target groups in the EU it is customary anyway.
Is a mere notice without an option to decline enough? According to the FDPIC's guide, not if non-essential cookies are set. The notice must also explain how visitors can decline. The law does not determine how this works technically.
Does the revDSG also apply to company data? The DSG protects personal data of natural persons. Since the revision, data of legal entities no longer falls under it. Anyone who identifies a company but not a person therefore touches the DSG only insofar as the information relates to an identifiable person. More on the distinction in Visitor identification and GDPR: a sober assessment.
