Cookie banners in Switzerland: does your site need one?

Every site owner has seen those banners covering the bottom of the screen, with a bright green button and a discreet link to refuse. Many conclude that the law requires one. For a Swiss site, that is often wrong. And where it is right, the reason is not the one people assume.

What Swiss law says

The rule on cookies sits in the Telecommunications Act, Article 45c, in force since 1 April 2007.¹ It protects the visitor’s device: any processing of data on that device must either serve transmission by telecommunication or, failing that, be controllable by the user. In practice, the site operator must inform visitors of the use of such technologies and of their purpose, state that they may refuse the processing, and say how.²

So this is not a regime of prior consent. It is a regime of information and opposition. The Federal Data Protection and Information Commissioner says so plainly in its guide: neither the FADP nor Article 45c requires consent for the use of non-essential cookies to be lawful.³ Consent is only one of the grounds that justify processing which infringes personality rights, alongside others.

What needs nothing

The same guide lists as essential the cookies a site cannot work without: a shop’s basket, the login to a protected area, the choice of language, data typed into a form still being filled in, or the recording of the choice made on a banner.⁴ The Commissioner adds that there is no binding catalogue of necessary cookies, and that necessity is also judged on content and retention period. In these cases the guide requires no choice window: the information belongs in the privacy policy.

A site that sets only these therefore, as a rule, has nothing to display beyond a mention in its privacy policy. Ours is such a case: it sets no cookie at all.

What needs visible information and a way to refuse

As soon as a site uses cookies that are not indispensable, for instance audience measurement or comfort settings, the operator must make the right to object easy to find, on the first visit as on later ones, so that refusing takes only a few clicks.⁵ The operator must also make sure that, until the visitor has been able to read the information and choose, the use of cookies stays at the minimum necessary.

Where consent becomes the rule again

The opposition regime has limits, which the Commissioner sets out in the guide, revised on 6 October 2025. Where non-essential cookies form part of a high-intensity processing, meaning sensitive data or high-risk profiling, the operator can no longer fall back on its private interest or on a mere right to refuse: it must obtain the visitor’s express consent before starting.⁶ Collecting location data can fall into this category, depending on how long it lasts, where it allows precise movement profiles to be built. The Commissioner also describes as a particularly serious infringement of personality rights the integration of third-party cookies that feed high-risk profiling across several sites. The guide adds that, until an analysis has ruled that threshold out, high risk must be presumed. A site that embeds an advertising pixel or a tool tracking visitors from one site to another should therefore expect to need express consent.

The difference with the European Union

The European directive on privacy and electronic communications requires prior, informed and freely given consent before any information is stored on or read from a user’s device, except where strictly necessary for the service requested.⁷ From this, European authorities derive in their practice the requirement that refusing be as easy as accepting, and that nothing non-essential be set before the choice.

This rule may concern you if your site targets a European audience. The audience test, rather than the place of hosting, comes from the General Data Protection Regulation; for cookies as such, it is the national laws transposing the directive that apply, and how far they reach a site established outside the Union varies from one country to another. We set out that test in the European law file and in the article describing how the two data protection regimes overlap. As a precaution, a Swiss site selling to German or French customers would do well to reason like a European one.

Three concrete cases

A showcase site presenting an activity, with no tracking tool and no non-essential cookie, needs no banner as a rule. A clear privacy policy is enough, and the Swiss law file summarises its compulsory points.

An online shop sets a basket cookie and sometimes a login cookie. Both are essential, so no banner. Everything changes once the shop adds detailed audience measurement, an advertising pixel or a social network module: the option to refuse must then be shown visibly, which usually means a banner, and prior consent becomes necessary in principle if the shop targets customers in the Union.

An association publishing its calendar and photos needs nothing more than a showcase site, as long as it embeds neither a video hosted by a third party nor a share button that sets its own cookies. Such embeds are the most frequent source of cookies the site’s owner did not know it had.

What to do on Monday morning

Start by finding out what your site actually sets. Open it in a browser, look at the list of cookies and other data it stores, and note those that are not working cookies. If the list is empty, you have nothing to display and only need to check that your privacy policy says so. If it is not, decide for each cookie whether it is really useful; those that are not can be removed, which settles the question at its root.

The simplest course, for a sole trader or a small business, remains to choose a site that sets nothing. The house’s prices are displayed, and a site built this way has no banner to maintain, no consent to collect and no consent manager to pay for. If you would like us to look at what your current site sets, write to us.

Notes

1. Telecommunications Act of 30 April 1997 (SR 784.10), Art. 45c. Date of entry into force recalled in the FDPIC guide, section 2.1. ↩

2. Telecommunications Act, Art. 45c(b), as summarised by the FDPIC, cookies guide, section 2.1. ↩

3. FDPIC, guide on data processing by means of cookies and similar technologies, version of 6 October 2025, section 3.12. Consent is one of the grounds of justification in Art. 31(1) of the Federal Act on Data Protection (SR 235.1). ↩

4. FDPIC, cookies guide, section 3.5.2 (table of uses regarded as essential) and the note on the absence of a binding catalogue. ↩

5. FDPIC, cookies guide, section 3.9 (granting the right to object and default settings). ↩

6. FDPIC, cookies guide, section 3.10.1 (high-intensity infringement); on the qualification as a particularly serious infringement, FDPIC announcement on the update of the guide. ↩

7. Directive 2002/58/EC of 12 July 2002, Art. 5(3). ↩