Table of content
Your client asks whether their website is "compliant". They target Switzerland, but part of their traffic comes from France or Germany, and their Google Ads campaigns run every day. Three sets of rules now apply to the same cookie banner: the FADP, the GDPR and Google's consent policy.
In short
FADP: fines of up to CHF 250,000 against individuals, for intentional violations.
The GDPR can reach a Swiss company that targets people in the EU or monitors their behaviour.
Google requires consent for personalised advertising, Switzerland included, since 31 July 2024.
For an agency, a single standard aligned with the GDPR is the easiest to deploy and maintain.
FADP and GDPR: the differences that matter to an agency
The FADP (Federal Act on Data Protection), in force since 1 September 2023, applies whenever processing has effects in Switzerland (Art. 3). Its fines, up to CHF 250,000, are imposed by the cantonal criminal authorities on the responsible individuals, for intentional violations (Art. 60 to 66). The FDPIC investigates and orders measures, but does not impose fines.
The GDPR also covers companies outside the EU that offer goods or services to people in the EU, or monitor their behaviour (Art. 3(2)). Its fines hit the company: up to EUR 20 million or 4% of worldwide turnover (Art. 83).
The most visible difference? Consent. In Switzerland, the FADP does not require it as a general rule (it must be explicit for sensitive data or high-risk profiling, Art. 6(7)), and Art. 45c of the Telecommunications Act requires information and a right to refuse cookies (opt-out). In the EU, non-essential cookies require prior consent (opt-in). More in our complete FADP and GDPR compliance guide.
Why align your clients with the strictest standard
"The client is Swiss, an opt-out will do." Sometimes true in law, rarely the right call:
European visitors are everywhere. Cross-border commuters, customers in France, a shop shipping to the EU: once the site targets these people or tracks their behaviour, the GDPR comes into play. Assess it case by case.
Google has decided for Switzerland. Without valid Google Consent Mode v2 signals, remarketing and conversion tracking degrade (see our Consent Mode v2 guide).
One setup for the whole portfolio: fewer mistakes, faster checks.
Trust: a clear banner that genuinely respects a refusal reassures visitors.
For a purely Swiss site with no personalised advertising, opt-out remains defensible: it is a risk decision, to be documented with the client.
A-Track tip
If the CMP shows a different banner to Swiss and EU visitors, keep the Consent Mode defaults at denied everywhere: Google asks for the consent of Swiss visitors too.
Choosing a CMP: the criteria that really matter
Poorly configured free plugins often set cookies before the visitor chooses. A good CMP (Consent Management Platform) offers native Consent Mode v2 with all four parameters, a Google Tag Manager template, real blocking before the choice, a consent log and a multilingual banner.
We have tested the main solutions (Cookiebot, Axeptio, Usercentrics): they all do the job. For agency site portfolios, we most often use Cookie-Script.
Why Cookie-Script suits Swiss agencies
Predictable pricing: Cookiebot charges by the number of subpages per domain; Cookie-Script offers unlimited pageviews on its paid plans, with only the number of scanned pages varying by plan (pricing).
Data hosted in Europe, in the Netherlands according to the vendor.
Consent Mode v2 in every plan, IAB TCF in the PLUS plan (see our article on IAB TCF 2.3).
A GTM tag template that simplifies consent-based triggers.
Turning compliance into an agency service
Compliance is a service you can sell, on your own or with a specialist partner. Your arguments:
Less legal risk. Art. 61 FADP also punishes anyone who entrusts data to a processor without meeting Art. 9. The agency running Google Tag Manager is often that processor: put it in a contract.
More reliable data. Badly wired consent distorts GA4 and Google Ads. In advanced mode, Google models missing conversions: according to Google (2021), more than 70% of ad-click-to-conversion journeys lost to refusals, on average.
A loyal client. If a competitor finds cookies set before the "Accept" click, you may lose the account.
To prepare for an inspection, see also the 5 documents the FDPIC may request.
Conclusion: three actions for your site portfolio
Map your client sites: target markets, advertising tools, CMP in place.
Test refusal: after "Reject all", no _ga, _gcl or _fbp cookie should appear.
Clarify roles: who maintains the CMP, who validates the legal texts, which contract binds the agency and its client.
Would your client sites pass the refusal test?
A-Track audits your clients' sites (CMP, Consent Mode v2, cookies set before the choice) and fixes the gaps, white-label or in partnership.
Start with a free tracking and compliance audit of one site, delivered within 48 hours.
