A client contacts you via your showcase website hosted in Switzerland, places an order, and then disputes the transaction because they could not find your address, your general terms, or any privacy policy. Under Swiss law, you are at fault. The legal obligations of a website in Switzerland are based on specific federal texts, with concrete consequences in case of non-compliance.
What the LCD actually imposes on Swiss websites
The Federal Act against Unfair Competition (LCD) serves as the foundation. Its article 3, paragraph 1, letter s, number 1, requires that anyone offering goods, works, or services on the internet clearly and completely indicates their identity and contact address, including an email address. The wording is broad: it applies to both e-commerce and a showcase site promoting services.
A professional blog offering consultations, a photographer’s portfolio with a “book now” button, an association website selling tickets: all fall under the LCD as soon as there is a commercial dimension. As soon as a contact form leads to a paid service, we fall within the scope of application.
To illustrate what this looks like in practice, you can consult the legal information on Tous Éco, which shows how to structure these mentions on a Swiss professional website.
Privacy policy and nLPD: the pitfalls
Since September 1, 2023, the new Federal Act on Data Protection (nLPD) applies in Switzerland. It requires any website operator collecting personal data to publish a detailed and accessible privacy policy. This applies to any collection, even a simple contact form that records a name and an email.
The privacy policy must identify several concrete elements:
- The identity and contact details of the data controller, i.e., the company or person who decides the purposes and means of processing.
- The categories of data collected, the purposes of processing, and any recipients (subcontractors, partners, technical service providers).
- Data transfers outside Switzerland, specifying the countries involved and the safeguards in place, a particularly sensitive point when using tools like Google Analytics or advertising pixels hosted in the United States.
The federal administration provides a useful benchmark: on the admin.ch sites, statistical tracking is controlled internally, limited to the domain, and the data remains in Switzerland. Most private sites cannot say the same. If you use a third-party audience measurement tool, your privacy policy must name this provider, describe the data transmitted, and indicate the storage country.
Cookie banner and consent: LCD, nLPD, or GDPR
The issue of the cookie consent banner creates frequent confusion in Switzerland. The nLPD does not require prior opt-in consent for all cookies, unlike the European GDPR. However, the obligation to inform does exist: the visitor must know which cookies are placed and for what purpose.
The pitfall lies in the target audience. If your site is visible from France, Germany, or Belgium, and targets (even partially) European users, the GDPR applies in parallel. A GDPR-compliant consent banner then becomes necessary, even with hosting and headquarters in Switzerland.
A properly configured cookie manager distinguishes strictly necessary cookies (which do not require consent) from analytical and advertising cookies (which do require consent under the GDPR). Many Swiss sites install a cosmetic banner that technically blocks nothing: this type of banner does not protect in case of an audit.
Cybersecurity and emerging obligations for Swiss sites
Beyond legal mentions and data protection, an additional aspect is emerging. Switzerland is preparing an autonomous federal law on cybersecurity, led by the Federal Office of Cybersecurity (OFCS). This future law is expected to adopt and expand the obligations arising from the Information Security Act.
For now, the incident reporting obligations mainly concern organizations related to critical infrastructures, not automatically every website owner. But for digital platforms or online services operating in sensitive sectors (health, finance, energy), this is a point to monitor right now.
What is changing on the ground: we are seeing more and more Swiss hosting providers incorporating enhanced security clauses into their contracts. If you outsource hosting, ensure that your contract covers incident notification and liability in the event of a data breach.
Checklist of mandatory legal mentions in Switzerland
Rather than listing generalities, here are the elements that the combined LCD and nLPD make necessary on a Swiss professional website:
- Full company name, legal form, physical address, and email address of the site manager (LCD, art. 3 para. 1 let. s).
- Registration number in the commercial register, if the company is registered, and VAT number if applicable.
- Privacy policy compliant with the nLPD, including processing purposes, third-party providers, and transfers outside Switzerland.
- General terms and conditions of sale for e-commerce sites, with information on the applicable right of withdrawal.
- Mention of the cookie manager used and the consent logic adopted (nLPD only or nLPD + GDPR depending on the target audience).
The absence of these elements constitutes an act of unfair competition under the LCD. The sanctions are not theoretical: a competitor or dissatisfied customer can initiate civil action, and the State Secretariat for Economic Affairs (SECO) can intervene in certain cases.
Compliance of a Swiss site is not determined by a single page, but by the consistency between legal mentions, privacy policy, and technical cookie settings. Updating these elements after each change of provider or tracking tool remains the most effective measure to avoid unpleasant surprises.
