Checklist: implementing cookies and consent correctly
For: Website operators in Switzerland and with EU audiences
Updated: 2026-11
Cookies are implemented correctly in seven steps: inventory all cookies and trackers, separate necessary from optional, determine the rules for your audience, in Switzerland inform users and allow refusal, for EU visitors set optional cookies only after consent, enforce the choice technically and review regularly.
In Switzerland, Art. 45c of the Telecommunications Act requires users to be informed about processing data on their devices and its purpose and to be able to refuse it. In the EU, ePrivacy law, implemented for example in Germany’s TDDDG, requires prior consent for non-essential cookies.
Many Swiss websites also target visitors from the EU. Those with both audiences usually implement the stricter model.
The checklist
- 01
Create an inventory
Record all cookies, pixels and third-party scripts with purpose, provider and lifetime.
Done when: A list of all cookies and trackers exists and has been checked technically.
- 02
Separate necessary and optional
Distinguish cookies needed for operation from those for analytics, marketing or convenience.
Done when: Every cookie is assigned to a category, with reasoning for necessary cookies.
- 03
Determine the audience
Clarify whether the website targets people in the EU and must therefore follow EU rules.
Done when: The choice of Swiss or EU model is documented.
- 04
Inform and allow refusal
For the Swiss model, inform clearly about cookies and offer simple refusal.
Done when: Information is visible on the first visit and refusal is possible without detours.
- 05
Consent for EU visitors
Set optional cookies only after active consent, with an equivalent option to refuse.
Done when: No optional cookies are set before consent, verified technically.
- 06
Enforce and evidence the choice
Implement the choice technically, store it and make it changeable at any time.
Done when: Settings can be changed at any time via a link, and consents are logged.
- 07
Review regularly
After website updates and new services, check whether new cookies were added.
Done when: A check is part of the release process and the privacy notice is updated.
Common mistakes
- —Showing a banner but loading trackers before consent.
- —Hiding refusal or making it much harder than accepting.
- —Adding new tracking services via a tag manager without updating banner and notice.
- —Assuming Swiss rules suffice although EU customers are targeted.
What this checklist does not cover
- —The checklist does not replace legal review in individual cases.
- —Requirements in EU member states and authority practice differ in details.
- —Data protection duties for processing the collected data remain in addition.
Parent service: Website Development
Matching offers
Privacy notice, legal notice and cookies for website and app
We record which services your website or app actually uses and implement a matching privacy notice, legal notice and cookie solution, under the Swiss FADP and, for EU audiences, the GDPR and ePrivacy law. Technically we ensure optional cookies are only set after visitors choose.
Technical SEO audit
A technical SEO audit examines the foundation of your findability: indexing, Core Web Vitals, structured data, crawling and site architecture. The result is a prioritised list of actions showing which technical levers deliver the greatest visibility gain — and in what order.
FAQ
Does a Swiss website need a cookie banner?
Swiss law requires information and a way to refuse, not necessarily a consent banner. Websites targeting EU visitors generally need a consent solution.
Are analytics cookies necessary?
Generally not. Privacy-friendly analytics tools without cookies can reduce the need for consent.
Where are consents stored?
In the consent solution, with time and chosen categories, so they can be proven in a dispute.
More checklists
Checklist: SEO migration in a website relaunch
Visibility is kept in a relaunch in seven steps: record all existing URLs and their performance, redirect every old URL to the matching new one, carry over strong content rather than replacing it, migrate metadata and structured data, test on staging, update sitemap and Search Console after go-live and monitor for weeks.
Checklist: writing a specification for a public IT tender
A specification for a public IT tender is created in seven steps: describe goals and starting point, formulate requirements with priority and acceptance criteria, keep technical specifications product-neutral, set suitability criteria, define award criteria with weighting and scoring method, create a comparable price sheet and review the documents before publication.
Checklist: taking out cyber insurance without jeopardising cover
Cyber insurance is taken out properly in seven steps: clarify needs and risks, implement the baseline measures the insurer requires, answer the questionnaire honestly and checked by IT, compare cover and limits, understand exclusions, add emergency rules to the incident response plan and keep evidence current.