Cookie Guidelines: updated version published
The FDPIC publishes an updated version of its cookie guidelines dated 22 January 2025, which contains specific clarifications and additions intended to improve the comprehensibility of the text and clarify practical issues.
The content of the updated guide is consistent with the first version dated 22 January 2025, which has been clarified and supplemented in specific areas in the new version. The update is intended to improve the comprehensibility of the text and clarify issues that have been raised with the Commissioner in practice.
In particular, the FDPIC found it useful to clarify why the use of cookies for the purpose of delivering personalised advertising may require the consent of the data subjects. This is the case, for example, when the website operator provides third parties with access to visitors' personal information in return for payment by integrating third-party cookies or similar technologies, and these third parties are embedded in several websites. As the latter are thus enabled to carry out high-risk profiling, this constitutes a particularly intensive intrusion into the privacy of the data subjects.
The FDPIC also made additions on the subject of location data collection – a type of data processing that is very widespread and entails particular risks: on the one hand, it facilitates the determination of an online user's real identity (for example, by reconstructing where a device is located during the night or sleeping hours, or at which addresses it is regularly located on working days). On the other hand, location data makes it possible to draw conclusions about essential aspects of the user's personality. Profiling based on location data therefore often represents high-risk profiling.
The updated version of the guidelines also addresses the use of so-called cookie paywalls. It explains whether and under what circumstances consent can be legally given if the data subject is given the choice between giving their consent or taking out a paid subscription.
The cookie guidelines are based on the Federal Data Protection Act (FADP SR 235.1), the Data Protection Ordinance (DPO SR 235.11), special data protection provisions under federal law, as well as federal court case law, relevant academic opinions and the FDPIC's supervisory practice to date. The document is aimed at a specialist audience.
In a next step, the FDPIC will conduct an awareness campaign aimed at a broader audience and then initiate the necessary supervisory measures in accordance with the guidelines.