GDPR and the Swiss revFADP: a checklist for your company website

Most data protection problems on a website are invisible. An analytics script loads before consent. A font comes from a server in the US. A form sends enquiries to a mailbox nobody knows about. Each detail on its own looks small.

This checklist walks through the points we find most often on company websites. It applies to Germany and Switzerland. It is not a substitute for legal advice. For your specific case, ask your data protection adviser.

Which rules apply

In Germany, the GDPR applies. For cookies and similar technologies, § 25 TDDDG is added. Until 2024 the law was called TTDSG. It requires consent before non-essential information is stored on or read from a device.

In Switzerland, the revised Federal Act on Data Protection (revFADP, German: revDSG) has applied since September 1, 2023. It is similar to the GDPR in many respects but less strict in some places. If a Swiss website also targets users in the EU, the GDPR can apply in addition. Art. 3(2) GDPR governs this. Many Swiss companies therefore align their website with the GDPR right away.

1. A cookie banner that actually blocks

A banner alone is not enough. It must block non-essential services until someone agrees. Check these points:

• “Reject” is as easy to reach as “Accept all”.
• No boxes are pre-ticked.
• Analytics, ad pixels and embeds load only after consent.
• Visitors can change their choice later, for example through a link in the footer.

Whether a banner blocks, you can see in your browser's developer tools. Open the Network tab and reload the page without agreeing. Every request to Google, Meta or LinkedIn is then a finding.

2. Embed fonts locally

Many websites load fonts directly from Google Fonts. That sends every visitor's IP address to Google. In 2022, the Munich Regional Court ruled this a violation without consent. Many cease-and-desist letters followed.

The fix is simple. Download the font files and serve them from your own server. Next.js does this automatically with next/font.

3. Analytics and tracking

Google Analytics can be used with consent. For transfers to the US, the EU-US Data Privacy Framework has existed since 2023. Switzerland has had its own counterpart since 2024. Even so, the tool needs consent through the banner.

An alternative is tools that work without cookies and host in the EU. They show visits, sources and goals without personal profiles. Which solution fits depends on how precisely you need to measure campaigns. Read more in Website without enquiries.

4. Maps, videos and social plugins

Embedded Google Maps, YouTube videos and social media feeds transmit data when they load. Load this content only after a click. Until then, the page shows a preview image with a short notice. For YouTube there is also the no-cookie mode at youtube-nocookie.com.

5. Contact and enquiry forms

• Ask only for what you need to reply.
• Transmit forms encrypted over HTTPS.
• Know where each enquiry goes and who can read it.
• Delete enquiries when you no longer need them.
• Link the privacy policy below the form.

A consent checkbox is usually not needed for a normal enquiry. The processing then serves to answer the enquiry. It's different for health data or a newsletter.

6. Hosting in the EU and data processing agreements

Host the website in the EU or in Switzerland. This makes a lot simpler. For every service provider that processes data on your behalf, you need a data processing agreement under Art. 28 GDPR. This covers hosting, email delivery, form services and analytics.

Keep a simple list: service, purpose, location, contract. You need this list for the privacy policy anyway. In our projects we set up hosting in the EU, and the accounts run in your name. Who should own the domain and hosting is covered in Domain, hosting and email.

7. A privacy policy that fits the website

Many privacy policies come from a generator and no longer fit. They name tools that were removed long ago and forget new ones. Compare the policy with your list from point 6. The revFADP also requires informing the people concerned, for example about purpose, recipients and countries.

8. Impressum (legal notice) and accessibility

The legal basics also include the Impressum (legal notice) and, depending on your offering, accessibility. What belongs in the Impressum is covered in Impressum in Germany and Switzerland. When the BFSG applies is covered in Accessibility Strengthening Act.

Frequently asked questions