Few data protection topics are as visible as the cookie banner — and few are implemented wrongly so often. For providers with customers in Switzerland and the EU, the rules also differ. This article describes the legal position and an implementation that holds up legally without mutilating the website.
The rule in the EU
The decisive law is not primarily the GDPR but the ePrivacy Directive: storing information on a device and accessing it are only permitted with consent unless strictly necessary for a service explicitly requested by the user. That covers not only cookies but comparable techniques such as local storage or fingerprinting. The GDPR standards apply to the validity of consent: freely given, informed, specific and by a clear affirmative action. Pre-ticked boxes are not enough; the Court of Justice of the EU ruled so in 2019.
Germany
In Germany, § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG, until 2024 TTDSG) implements the rule. Supervisory authorities pay particular attention to rejecting being as easy as accepting, to no misleading design and to no consent-requiring scripts loading before consent.
Switzerland
Switzerland has no general consent requirement for cookies. Under the Telecommunications Act, website operators must inform about the use of cookies and their purpose and explain how processing can be refused. On top come the information duties of the revised FADP, met in the privacy notice. Consent may still be needed, for example for processing sensitive data or for high-risk profiling. Anyone addressing visitors from the EU must also observe the EU rules.
What makes a clean banner
- Equal choice: “accept all” and “reject all” on the same level and equally visible.
- Nothing loads beforehand: consent-requiring scripts only after consent.
- Understandable purposes: categories in plain language, not dozens of vendors without explanation.
- Withdrawal at any time: a permanently reachable link, for example in the footer.
- Evidence: document consent with timestamp and banner version.
Less is more
The best banner strategy is to use less consent-requiring technology. Many websites load tools nobody analyses. For measuring findability, Search Console is often enough; for visitor statistics there are solutions that need no storage on the device and process data in the EU or Switzerland — though they too must be assessed under data protection law. Every script saved is one script fewer in the banner, in the privacy notice and in your Core Web Vitals.
Advertising and measurement
Anyone using advertising platforms and wanting to measure conversions in the EU can hardly avoid a consent solution. The major platforms now require consent signals to be passed correctly. A clean technical integration that respects consent while still providing the data campaigns need, as far as permitted, pays off here.
In SaaS products
Inside the signed-in application, much storage is technically necessary, for example for sign-in, and needs no consent. Product analytics evaluating user behaviour, by contrast, need closer review. Limiting them to what is needed, capturing them pseudonymously and describing them clearly in the privacy notice has proven itself. Disclosures abroad to analytics providers follow the rules described in our article on data transfers.
Reviewing banner, scripts and privacy notice is part of our GDPR audit for SaaS and our revised FADP implementation for SMEs.