Swiss Data Protection Law in Marketing: Tracking, Cookies and Newsletters
The revised Swiss Federal Act on Data Protection, in German revDSG or simply DSG, regulates how organisations handle personal data and has applied since 1 September 2023. For marketing teams it decides how you may run cookies and tracking, newsletters, forms and tools from abroad. This guide sorts out what the law and the federal data protection authority actually say about each, and where the rules remain a matter of judgement. It is a guide, not legal advice and not a pitch: if you need help with a measurement setup that takes data protection into account, see our performance marketing agency page.
What is the revDSG, and who does it apply to in marketing?
The act protects the personality and fundamental rights of natural persons about whom personal data is processed (Art. 1 DSG). Personal data is any information relating to an identified or identifiable natural person (Art. 5 lit. a). The act replaced the data protection act of 19 June 1992 and entered into force on 1 September 2023.
It applies to private persons and federal bodies (Art. 2), and it reaches facts that have an effect in Switzerland even if they originate abroad (Art. 3). A foreign advertiser whose tracking affects visitors in Switzerland can therefore fall under it.
Two roles matter for agencies and tool providers. The controller is the person or body that decides, alone or together with others, on the purpose and the means of the processing. The processor processes personal data on behalf of the controller (Art. 5 lit. j and k). If you hand data processing to an agency or a platform, Art. 9 requires that the data is processed as you yourself would be allowed to, and that you make sure the processor can guarantee data security. Handing processing over without meeting these conditions is a punishable offence if done intentionally (Art. 61 lit. b).
What applies to cookies and tracking?
The Federal Data Protection and Information Commissioner (FDPIC, in German EDÖB) names two legal bases in its cookie leaflet of 27 March 2026. Art. 45c of the Telecommunications Act allows processing data on other people's devices only if users are told about the processing and its purpose and are told that they can refuse it. The data protection act governs the personal data collected through cookies. The leaflet applies the same logic to similar technologies: web beacons that detect when an email is opened, local browser storage, device fingerprinting and advertising IDs.
The decisive difference to the EU, in the FDPIC's words: European law requires prior explicit consent for cookies except necessary ones, while Swiss law puts the weight on transparent information and the right to object. In principle, users must be informed about non-essential cookies and their purpose and must be able to decline them, in principle before the cookies are activated (opt-out). Prior explicit consent is required where the processing can be classed as unexpected or as high risk, or involves sensitive personal data.
That gives you a working way to sort what you run. This is our reading of the leaflet, not a legal classification:
Necessary cookies (session, shopping basket, security): describe them in the privacy notice.
Analytics and performance cookies: the leaflet describes them as collecting anonymised navigation data without passing it on to third parties. Inform users and offer an opt-out.
Marketing and personalisation cookies, often placed by third-party ad partners: the leaflet notes that they store interests and behaviour to build detailed profiles. Inform users, offer an opt-out and check whether the processing counts as unexpected or high risk, which would need prior explicit consent.
Whether a specific tool falls under high-risk processing is a case-by-case question. The act defines profiling as automated processing of personal data to evaluate or predict personal aspects such as interests, behaviour or location, and high-risk profiling as profiling that links data in a way that allows an assessment of essential aspects of a person's personality (Art. 5 lit. f and g). Explicit consent is required for high-risk profiling by a private person (Art. 6 para. 7), and any consent is valid only if given voluntarily for specific processing after adequate information (Art. 6 para. 6). The FDPIC refers to its detailed cookie guide for the criteria.
Many Swiss sites follow the European standard and show a banner with granular choices, as the leaflet notes. If you also address EU audiences, check the stricter EU requirement for prior explicit consent.
Swiss law puts the emphasis on transparent information for users and their right to object.
EDÖB, Merkblatt zur Verwendung von Cookies und ähnlichen Technologien im Zusammenhang mit Online-Tracking, 2026 (own translation)
How are newsletters and email marketing regulated?
Email and SMS marketing is governed by the unfair competition act, not by the data protection act alone. Under Art. 3 para. 1 lit. o UWG it is unfair to send mass advertising by telecommunication, without a direct connection to requested content, without first obtaining the customer's consent, without stating the correct sender or without pointing to an easy and free way to decline. There is one exception: if you received a customer's contact details in the course of a sale and pointed to the opt-out, you may send mass advertising for your own similar goods, works or services without consent.
In practice, that comes down to four rules:
Get consent before the first campaign to new contacts, through a clearly worded sign-up.
State the correct sender in every message.
Put a working, free unsubscribe option in every message.
Use the customer exception only for your own similar offers, and only if you mentioned the opt-out when you collected the address.
Double opt-in, where the subscriber confirms the address by clicking a link, is our standard way to document consent. It is common practice, not a requirement stated in the act.
Two data protection points sit on top. The sign-up form must give the information required by Art. 19 DSG, described below. And tracking pixels in newsletters count as tracking technology: the FDPIC lists web beacons that detect when an email is opened among them. Mention open tracking in your privacy notice.
What must a privacy notice contain, and who is liable?
Art. 19 DSG requires the controller to inform the person appropriately when personal data is collected. At a minimum you provide the identity and contact details of the controller, the purpose of the processing and, where relevant, the recipients or categories of recipients. If data is disclosed abroad, you also name the state and the safeguards or the exception relied on. A privacy notice that is easy to find is the usual way to meet this.
Exceptions exist, for example when the person already has the information or the processing is provided for by law (Art. 20). Do not rely on them for standard marketing data.
Two more duties belong on every marketing team's radar. Controllers and processors keep a record of their processing activities (Art. 12). The Federal Council provides exceptions for companies with fewer than 250 employees whose processing carries a low risk (Art. 12 para. 5). The details sit in the ordinance, which we have not reviewed here, so check it for your case. And a breach of data security that is likely to lead to a high risk must be reported to the FDPIC as soon as possible (Art. 24).
Fines are real but narrower than often described. Intentionally failing to inform people under Art. 19, or giving false or incomplete information, is punishable with a fine of up to CHF 250,000, mostly on complaint (Art. 60). The same ceiling applies to intentionally disclosing data abroad without the required safeguards, handing processing to a processor without meeting the Art. 9 conditions, or ignoring the minimum security requirements (Art. 61). The fines target private persons, that is the responsible individuals, not the company automatically. For fines up to CHF 50,000, the authority may fine the business instead if identifying the individuals would be disproportionate (Art. 64). The cantons prosecute, and the FDPIC can file a report (Art. 65).
Can you use US tools such as Google Analytics or the Meta pixel?
There is no blanket yes or no, because the answer depends on the data flows and on how the tool is configured. Many marketing tools process data in the USA. Under Art. 16 DSG, personal data may be disclosed abroad if the Federal Council has determined that the other state's legislation ensures adequate protection. Without such a decision you need safeguards such as an international treaty, data protection clauses notified to the FDPIC or standard clauses recognised by the FDPIC. Art. 17 lists exceptions, for example the person's explicit consent.
For the USA, the Federal Council decided on 14 August 2024 that the certification of US companies and a new US data protection court allow transfers of personal data from Switzerland to certified companies in the USA without additional safeguards. The change to the data protection ordinance entered into force on 15 September 2024 (Federal Council announcement). The decision covers certified organisations only, so check each provider on the official Data Privacy Framework list and note the date of the check.
A short checklist for your next review:
List every tool that sets cookies or collects visitor data, and note who the processor is and where the data goes.
For each US provider, check the certification and record the date.
Make sure processor contracts exist and meet Art. 9.
Compare the banner and the privacy notice with what the tools actually do.
Name the countries and safeguards in the privacy notice (Art. 19 para. 4).
Decide for each marketing tool whether it could count as unexpected or high-risk processing, and document the reasoning.
Set a review date, because tools and rules change.
For the legal side of AI-generated ads, see our guide to AI images and the law in Switzerland. For the broader debate about targeting, see our essay on targeted advertising and privacy.
Want a measurement setup that takes data protection into account?
Collective Agency sets up tracking and reporting with data protection in mind from the start. Get in touch with our team for a no-obligation conversation about your setup. This guide is not legal advice: for binding answers, consult your legal counsel.
Where consent of the data subject is required, it is valid only if it is given voluntarily for one or more specific processing operations after adequate information.
Datenschutzgesetz (DSG), Art. 6 Abs. 6, SR 235.1 (own translation)
Summary
This guide explains what the revised Swiss Data Protection Act means for marketing teams, based on the act itself and the cookie leaflet of the federal data protection authority. It shows how Swiss rules on cookies and tracking differ from the EU's, what the unfair competition act requires for newsletters, what a privacy notice must contain and which fines exist and whom they target. It also covers transfers to the USA after the Swiss-US Data Privacy Framework of September 2024 and ends with a checklist for the next review. It is not legal advice.
Related Articles
Brand Strategy: Building Blocks, Process and Common Mistakes
Published
By
Joël Wyss
ChatGPT Ads Are Live in Switzerland: What Changed on 24 August
Published
By
Dino Reichmuth
How ChatGPT Ads Work: Formats, Costs and Where They Run
Published
By
Dino Reichmuth
AI Images in Advertising: The Legal Position in Switzerland
Published
By
Lars Kienle