Cookie banners are among the most visible consequences of data protection law. Whether and in what form they are needed depends on which law applies to a website’s audience.
EU: consent before setting
Under Art. 5(3) of the ePrivacy Directive, implemented in Germany in the TDDDG, information may only be stored on or read from users’ devices if they have consented, unless strictly necessary for the requested service. Consent must meet GDPR requirements: freely given, specific, informed and unambiguous. In 2019 the Court of Justice of the EU ruled in Planet49 that pre-ticked boxes are not valid consent.
Switzerland: information and refusal
Art. 45c of the Telecommunications Act permits processing data on others’ devices if users are informed about the processing and its purpose and told they can refuse it. Swiss law therefore generally requires no prior consent. Subsequent processing of personal data is also governed by the FADP.
Good implementation
A banner that makes refusing as easy as accepting, loads no optional trackers before the choice and makes the choice changeable at any time meets the requirements and looks trustworthy. Many Swiss websites with EU audiences apply the EU model to all visitors. The steps are in our cookies and consent checklist.