Swiss website with customers in Italy: FADP and GDPR together, cookie banner and domain
Does your Ticino website also target customers in Italy? When the GDPR applies on top of the FADP, and how to set up cookie banner and privacy policy.
If a Ticino website deliberately targets customers in Italy as well, the EU General Data Protection Regulation (GDPR) usually applies in addition to the Swiss Federal Act on Data Protection (FADP). In practice you need a privacy policy that covers both laws, a cookie banner with prior consent for non-essential tools and, depending on the case, a representative in the EU. This article is general information, not legal advice.
When does a Swiss website have to comply with the GDPR?
The GDPR also applies to businesses without an establishment in the EU if they offer goods or services to people in the EU or monitor their behaviour, for example with tracking and targeted advertising (Art. 3(2) GDPR). For a Ticino website, the Italian language alone is not enough, because it is the language of the canton. Indicators like these matter more:
- prices also in euros or deliveries to Italy;
- an .it domain or a dedicated section for Italy;
- an Italian phone number or contact address;
- advertising campaigns aimed at users in Italy, for example in Lombardy or Piedmont;
- explicit references to customers in Italy, such as “delivery to Milan in 48 hours”.
A restaurant in Ascona that receives the occasional booking from Italian holidaymakers is in a different situation from a consultancy in Chiasso actively looking for clients in Como and Varese. If in doubt, it is worth setting up the website to meet both laws: the practical differences are smaller than many people think.
FADP and GDPR compared: the differences that matter
| Topic | FADP (Switzerland) | GDPR (EU) |
|---|---|---|
| In force | 1 September 2023 (revised FADP) | 25 May 2018 |
| Legal basis | Not required for every processing; the processing principles are what counts | Every processing needs a legal basis (Art. 6), such as contract, consent or legitimate interest |
| Non-essential cookies | Information and the option to refuse (Art. 45c Telecommunications Act) | Prior consent (ePrivacy Directive; in Italy, the Garante’s 2021 guidelines) |
| Data security breaches | Report to the FDPIC as soon as possible if there is a high risk | Report to the supervisory authority within 72 hours unless the risk is unlikely |
| Sanctions | Fines of up to CHF 250'000 against the responsible individuals | Fines of up to 20 million euros or 4 % of worldwide annual turnover |
| Authority | FDPIC | In Italy, the Garante per la protezione dei dati personali |
In short: the GDPR is stricter on cookies and legal bases. If you comply with the GDPR, you will in most cases comply with the FADP too, provided your privacy policy also includes the information Swiss law requires, such as the countries to which data is disclosed.
EU representative: is one really needed?
Anyone who falls under the GDPR without an establishment in the EU must generally designate a representative in the EU in writing (Art. 27 GDPR). The obligation does not apply if the processing is occasional, does not include large-scale processing of special categories of data and is unlikely to result in a risk to the people concerned. For a small website with a contact form, this exception may be enough; for an online shop that sells regularly to Italy, with customer accounts and a newsletter, it usually is not. Specialised providers offer representative services.
Cookie banner: one solution for Switzerland and Italy
The Italian data protection authority (Garante) set clear rules in its cookie guidelines of 10 June 2021. The most important ones for the banner:
- technical cookies (session, cart, language) do not require consent;
- analytics that identify users, advertising and social media require prior consent: the script only starts after a click on “Accept”;
- scrolling does not count as consent;
- closing the banner with the X keeps the default settings, which means refusing non-essential cookies;
- the banner should not be shown again for six months unless something important changes;
- users must be able to change their choice at any time, for example via a link in the footer.
In Switzerland, information and an option to refuse are in principle sufficient. Showing two different banners depending on where visitors come from is complicated and unreliable, though: IP-based location is often wrong for cross-border commuters and on mobile networks near the border. The simplest solution is a single banner with prior consent for everyone.
Tip: Test the banner in a private browser window: in the Network tab of the developer tools, there should be no requests to Google Analytics, Meta or similar services before you click “Accept”.
One privacy policy for both laws
A single privacy policy, in Italian and the other languages of the website, can cover the FADP and the GDPR if it includes:
- the controller with address and contact details and, if designated, the EU representative;
- which data you collect, for what purposes and, for the GDPR, on which legal basis;
- recipients and service providers (hosting, newsletter, payments, analytics) and the countries where they are located;
- the retention period or the criteria used to determine it;
- the rights of data subjects (access, rectification, erasure, objection, data portability);
- the right to lodge a complaint with the FDPIC and, for people in the EU, with the competent supervisory authority, in Italy the Garante.
Transfers between Switzerland and Italy need no additional safeguards: the EU recognises Switzerland as providing an adequate level of protection, confirmed by the European Commission in January 2024, and Switzerland recognises the same for EU member states. For service providers in the United States, check whether they are certified under the Data Privacy Framework.
.ch or .it domain for customers in Italy?
For a Ticino business, .ch usually remains the main domain: it is well known, inexpensive and needs no explanation. An .it domain can make sense if you also want to present yourself as a supplier on the Italian market, for example with prices in euros and a dedicated section.
- Who may register an .it domain: according to the Italian registry (nic.it), adults and organisations with citizenship, residence or registered office in the European Economic Area, Vatican City, San Marino, Switzerland or the United Kingdom. A Ticino company can therefore register one; still check the current conditions on nic.it before ordering.
- An .it domain does not change the data protection rules, but it is a strong sign that you are targeting the Italian market: from then on, the GDPR almost certainly applies.
- For search engines you can use a single website with language versions marked with hreflang, for example it-CH for Switzerland and it-IT for Italy, or redirect the .it domain to the Italian section of the .ch website.
- At HostOn an .it domain costs CHF 23.90 per year and a .ch domain CHF 14.90 per year, with registration and renewal at the same price (VAT included, as of October 2026).
Checklist for your website
- Assess whether the website actively targets customers in Italy.
- Cookie banner with prior consent and an equally simple way to refuse.
- One privacy policy for the FADP and the GDPR, with legal bases and the countries of your service providers.
- EU representative, if the exception does not apply.
- Data processing agreements with your hosting, newsletter and analytics providers.
- Internal procedure for data breaches: who reports what, to whom and by when.
- SSL certificate on every page and forms submitted only over HTTPS.
At HostOn you manage .ch and .it domains, hosting and mailboxes in the same client area, and the SSL certificate is included free of charge in every hosting plan and renewed automatically.
Frequently asked questions on this topic
Only if it offers goods or services to people in the EU or monitors their behaviour, for example with tracking and targeted advertising. A Ticino website that ships to Italy or advertises there generally falls under the GDPR.
No. Italian is a national language of Switzerland. What counts more are prices in euros, deliveries to Italy, an .it domain or advertising aimed at people in Italy.
Yes. According to nic.it, adults and organisations with citizenship, residence or registered office in the European Economic Area, Switzerland, San Marino, Vatican City or the United Kingdom may register an .it domain. Check the current conditions before ordering.
The Telecommunications Act requires you to inform users about cookies and let them refuse; prior consent is not generally required. If the website also targets Italy, however, you need prior consent for non-essential tools.
Generally yes, if the GDPR applies and the processing is not merely occasional and low-risk (Art. 27 GDPR). A small website with a contact form often does not need one; an online shop with regular customers in Italy usually does.
Yes. The European Commission recognises Switzerland as providing an adequate level of data protection, confirmed in January 2024, so no additional safeguards are needed for the transfer.
