FADP & GDPR Compliance: The Complete Guide for Swiss & European Businesses in 2026

The practical guide to making your website compliant without losing your marketing data. FADP or GDPR, real penalties, a cookie banner that works, Consent Mode v2 and a strategy for your company size, with an 8-question checklist.

Table of content

1. Compliance has become a marketing issue

Diagram of the three risks of a badly wired cookie banner: legal risk (fines up to CHF 250,000 on the individual responsible), advertising risk (Google has required consent for Switzerland since 31 July 2024) and trust risk.

For a long time, the cookie banner was seen as a legal formality. Not anymore: a badly wired banner exposes a company to three risks at once.

  • Legal risk: the FADP provides for fines of up to CHF 250,000, imposed on the individuals responsible.

  • Advertising risk: since 31 July 2024, Google has applied its consent policy to Swiss visitors. Without consent signals, remarketing and conversion measurement deteriorate.

  • Trust risk: a visitor who sees trackers firing before they have made a choice does not come back.

At A-Track, we handle these three risks together: what is legally right must also work technically.

2. FADP or GDPR: which law applies to your website?

Comparison table of the FADP and GDPR: date in force, who is penalised, maximum fine (CHF 250,000 versus EUR 20 million or 4% of global turnover), authority, cookie rules and framework for transfers to the United States.

Often both. The revised FADP has been in force since 1 September 2023. The GDPR also applies to a Swiss company as soon as it offers goods or services to people in the European Union, or monitors their behaviour online (Article 3 GDPR).

  • Who is penalised? The FADP mainly targets the individuals responsible, and only for intentional violations (Art. 60 to 63 FADP). The GDPR targets the company, up to EUR 20 million or 4% of worldwide turnover.

  • Cookies: in Switzerland, the Telecommunications Act (Art. 45c TCA) requires you to inform visitors and let them refuse. In the EU, prior consent is required for any non-essential tracker. As soon as you have European visitors or use Google Ads, aim for the stricter standard.

  • Transfers to the United States: they are possible to companies certified under the Swiss-U.S. Data Privacy Framework, in force since 15 September 2024. They must be documented in your privacy policy.

3. From complaint to penalty: how it works

Five-step diagram of an FADP procedure: complaint, FDPIC investigation, decision ordering measures without a fine, prosecution by the cantonal criminal authority, fine of up to CHF 250,000 for intentional violations.

The Federal Data Protection and Information Commissioner (FDPIC) can open an investigation on its own initiative or following a report, for example after a complaint from a customer or a competitor. It can order measures, but it does not impose fines itself.

Fines are a matter for the cantonal criminal authorities. They cover in particular intentional breaches of information duties, failure to comply with an FDPIC decision and breaches of the duty of care. If the fine does not exceed CHF 50,000 and identifying the individual responsible would be disproportionate, the company can be fined instead (Art. 64 FADP).

Key point: your best protection is being able to prove what your website does. Consent logs, an up-to-date tracker list and a privacy policy that matches the technical reality.

Consent diagram: the visitor chooses in the banner (CMP), which informs, blocks trackers before the choice and keeps proof; Consent Mode v2 sends four signals; if accepted, tags work fully; if refused, nothing is sent in basic mode and only cookieless signals are sent in advanced mode for modelling.

A banner that is displayed but blocks nothing is decorative. A CMP (Consent Management Platform) must do three things: inform, block trackers until the visitor has chosen, and keep proof of that choice.

Google Consent Mode v2 links that choice to your Google tags through four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.

  • Basic mode: Google tags only load after acceptance. Nothing is sent after a refusal.

  • Advanced mode: after a refusal, tags send cookieless signals that let Google model part of the conversions. According to Google, this modelling recovers more than 70% of the ad-click-to-conversion journeys lost to consent choices.

In both cases, the visitor's choice is respected. The difference is the quality of measurement, and it must be explained in your privacy policy.

5. Which strategy for your company size?

Three levels of compliance strategy: small businesses (Google-certified CMP, accurate tracker list, clear privacy policy), SMEs and e-commerce (multilingual CMP, Consent Mode v2, server-side tracking), large companies and regulated sectors (data flow mapping, Swiss or EU hosting, technical documentation).

Small businesses and freelancers

A showcase site, a form, few tools. The essentials: a Google-certified CMP, an accurate tracker list and a clear privacy policy.

SMEs and e-commerce

You invest in advertising and your decisions depend on the numbers. You need a multilingual CMP, properly configured Consent Mode v2, regular tracker checks and, often, server-side tracking to make conversions reliable.

Large companies and regulated sectors

Finance, healthcare, industry: several domains, compliance teams and sensitive data. You need to map data flows, control recipients, choose where data is hosted (Switzerland or EU) and provide technical documentation your data protection officer can actually use.

6. The 5 steps to compliance with A-Track

The five A-Track compliance steps: audit of everything the site loads, choice of a Google-certified CMP, setup (prior blocking, Consent Mode v2, Tag Manager), legal documents that match reality, monitoring after every update.

  1. Audit: we record everything your site loads before and after the visitor's choice.

  2. CMP selection: a Google-certified tool that fits your CMS, languages and budget.

  3. Technical setup: prior blocking, Consent Mode v2 and Google Tag Manager.

  4. Documents: privacy and cookie policies aligned with what actually runs.

  5. Monitoring: regular checks, because one new plugin or update is enough to undo everything.

7. Is your website compliant? 8 questions to ask yourself

  1. Do advertising trackers load before the visitor has chosen?

  2. Is the "Reject" button as visible as the "Accept" button?

  3. Is your CMP on Google's list of certified CMPs?

  4. Does Consent Mode v2 send all four signals?

  5. Do you keep proof of consent?

  6. Does your privacy policy list every provider actually present on the site?

  7. Do you know which countries your data goes to?

  8. Does anyone check the site after every update?

A single uncertain answer is enough to justify a check. Request your free audit within 48 hours, or see our services and prices. For the impact on marketing measurement, read our Performance marketing and tracking guide.

Tracking and Compliance News

View all

Suivez l'évolution technique et juridique du tracking de données marketing et les dernières mises à jour en conformité Suisse et Européenne.

Questions fréquemment posées

What is the "Privacy by Design" imposed by the FADP?

▾
This means that data protection must be integrated from the design stage of your website or marketing campaigns, and not added at the end. Tracking must be configured to collect the minimum amount of necessary data.

What is the major difference between the FADP (Switzerland) and the GDPR (EU) for a website?

▾
Although very similar, the FADP (Federal Act on Data Protection) favors a risk-based and transparency approach, while the GDPR imposes a stricter framework on prior consent. However, if you are targeting European customers, you must comply with the GDPR, which is the highest standard.

What is the added value of a Swiss expert for the FADP?

▾
Knowledge of local subtleties. For example, knowing how to configure geolocation to apply the strict rules of the GDPR to EU visitors while maintaining more flexibility for Swiss visitors (if the strategy allows it).

What are the financial risks in case of non-compliance with the FADP?

▾
The GDPR provides for fines against companies of up to EUR 20 million or 4% of worldwide annual turnover (Art. 83 GDPR). The FADP works differently: it provides for criminal fines of up to CHF 250,000 against the responsible individuals, for intentional breaches of certain duties (information, cooperation, due diligence, professional secrecy, Art. 60 to 63 FADP).

These fines are imposed by cantonal criminal authorities; the FDPIC investigates and orders measures but does not impose fines. Indirect costs come on top: rushed remediation, reputational damage, limited advertising features.

Is the Meta Pixel compliant with the FADP in Switzerland?

▾
It can be, provided it is configured properly. In Switzerland, Art. 45c of the Telecommunications Act requires informing visitors about cookies and letting them refuse; the FADP requires transparency about the purposes and recipients of the data, Meta included. For EU visitors, the GDPR and the ePrivacy Directive require prior consent.

In practice, the simplest approach is to fire the Pixel only after consent, through your CMP. Server-side tracking lets you control and limit the data sent to Meta, but it does not replace consent: a refusal is still a refusal.

Is data compliance a hindrance to marketing performance?

▾
No, it's the opposite. "Clean" and compliant tracking (especially via Server-Side) improves the quality of the collected data as it is filtered and structured, increasing the trust of advertising algorithms.

Is a CMP enough to be compliant?

▾
No. The CMP must be connected to the rest of the site (tags, analytics, CRM) to actually block non-essential cookies before consent.

What documents does the FDPIC request during an FADP audit?

▾
The FDPIC has no fixed list, but during an investigation (Art. 49 and 50 FADP), five documents often come up:

1) The record of processing activities (Art. 12 FADP), from which companies with fewer than 250 employees are partly exempt.
2) Proof of consent choices, where you rely on consent (EU visitors, Google's policy).
3) The safeguards for data transfers outside Switzerland (Art. 16 FADP, for example the Swiss-U.S. DPF or standard clauses) and, if the processing is high-risk, an impact assessment (Art. 22 FADP).
4) Technical proof that non-essential trackers respect the visitor's choice (data protection by design and by default, Art. 7 FADP).
5) The processing agreements with your service providers (Art. 9 FADP).