The Federal Data Protection and Information Commissioner (FDPIC) of Switzerland provides a comprehensive framework for cookie usage and similar tracking technologies under the Federal Act on Data Protection (FADP) and Telecommunications Act (TCA). These guidelines set legal standards for data controllers, including transparency, consent, and user rights regarding cookies and tracking technologies.
Key Takeaways
1. Scope and Legal Basis
- The guidelines are based on FADP, DPO (Data Protection Ordinance), and TCA.
- They align with Swiss federal court rulings, EU GDPR principles, and doctrinal interpretations.
- The TCA (Art. 45c) provides additional cookie-related rules to protect device integrity.
2. Cookie Classification & Definitions
The guidelines distinguish between different types of cookies based on storage, function, and ownership:
- Session Cookies: Temporary, deleted when the session ends.
- Persistent Cookies: Stored for longer, used for returning visitors.
- First-Party Cookies: Set by the website owner.
- Third-Party Cookies: Set by external entities (e.g., advertisers, analytics providers).
- Tracking Technologies Beyond Cookies: Includes fingerprinting, ID graphs, pixels, and authentication caches.
Cookies are widely used for:
- Website functionality (e.g., shopping carts, logins, language preferences).
- Analytics and tracking user behavior.
- Targeted advertising (including cross-site profiling).
3. Personal Data and Cookies
- Cookies can contain personal data when they store identifiable information (e.g., unique IDs, IP addresses, device IDs).
- Even if cookies store non-identifiable data, they can become personal if combined with other tracking technologies.
- Websites must assume potential personal data processing and apply data protection principles accordingly.
4. Responsibilities of Website Operators
- The website owner is responsible for cookies, and other tracking technologies, used on their site.
- If third-party services (e.g., Google Analytics, Facebook Pixel) collect data, the website operator shares responsibility.
- Websites must ensure compliance with both Swiss and international data protection laws.
5. Transparency and User Information Obligations
Website operators must clearly inform users about:
- What data is collected and why.
- Who processes the data (first-party vs. third-party).
- Whether data is transferred internationally.
- How users can exercise their rights (opt-in, opt-out, data deletion, etc.).
6. Legal Basis for Using Cookies
Cookies, and other tracking technologies, are only allowed if they meet one of these justifications:
- Technically necessary cookies: Essential for website functionality (e.g., logins, payment processing).
- Overriding private interests: Businesses must prove that their interests outweigh user privacy concerns.
- User consent: Required for non-essential cookies.
7. Consent and the Opt-in vs. Opt-out Debate
- Consent must be informed, voluntary, and specific.
- Opt-out is insufficient for high-risk processing, as once data is shared with third parties, revocation is nearly impossible.
- Dark patterns and nudging are prohibited—consent must be genuine and free from manipulation.
- If a website requires consent for access, it must provide an alternative to users who refuse tracking.
8. High-Risk Tracking and Profiling
The guidelines introduce a risk-based classification for cookies:
- High-risk profiling includes tracking across multiple websites and combining data from different sources.
- Websites engaging in high-risk profiling must obtain explicit opt-in consent.
- Profiling for political, religious, or trade union purposes always requires explicit consent.
9. Cookie Banners & Technical Implementation
- Consent must be obtained before setting non-essential cookies.
- Websites must implement a two-click system—JavaScript tracking should not activate until consent is granted.
- Users must be able to withdraw consent as easily as they gave it.
10. Enforcement and Penalties
- Websites failing to comply with FDPIC guidelines may face regulatory action.
- Non-compliant tracking practices could lead to legal consequences under Swiss data protection law.
- Federal authorities have stricter obligations than private entities.
Final Assessment
Strengths
- Aligns with GDPR principles while tailoring rules to Swiss law.
- Establishes a clear risk-based framework for cookie regulation.
- Emphasizes transparency, user rights, and accountability.
- Prohibits deceptive consent mechanisms and dark patterns.
Weaknesses & Limitations
- Opt-out remains an option for mid-level risk profiling, which is problematic since once data is shared, it cannot be revoked.
- No direct ban on third-party tracking cookies, despite their privacy risks.
- Loopholes in the balancing of interests—businesses can still justify tracking without consent in some cases.
Conclusion
The FDPIC guidelines represent a strong step toward regulating cookies and others forms of tracking in Switzerland, setting a framework that emphasizes transparency, accountability, and user control. However, opt-out mechanisms remain a weak point, as they fail to provide true consumer protection once data has been shared. Websites and businesses must rethink their reliance on invasive tracking technologies and adopt privacy-first alternatives.
Ronni K. Gothard Christiansen
Creator AesirX.io
