In Switzerland, the federal law against unfair competition (LCD) requires operators of commercial websites to display certain information that allows them to be identified. Since September 1, 2023, the revised federal data protection law (LPD) adds an additional layer of requirements for any site that collects personal data.
The Swiss legal framework is therefore not limited to a simple legal notice page: it articulates several texts whose contours deserve to be examined closely.
LCD and LPD: two distinct laws governing legal notices in Switzerland
Confusion is common: many operators believe that a single page covers all their obligations. The LCD (art. 3, para. 1, let. s) aims for commercial transparency. It concerns anyone offering goods, works, or services online, or by any other means of electronic commerce.
The revised LPD, on the other hand, regulates the processing of personal data. Its scope is broader: a showcase site without a sales function but that uses a contact form or a traffic analysis tool falls under this law. A non-commercial site may escape the LCD but not the LPD as soon as it collects data.
The ordinance on price indication (OIP) and the code of obligations (CO) complement the framework for online shops, particularly regarding the stages of the ordering process and contractual confirmation. A concrete example of a legal notice page compliant with Swiss law can be viewed on the site www.tous-eco.ch, which allows for visualizing the expected typical structure.
Mandatory content of legal notices according to Swiss LCD
Article 3 of the LCD requires a clear and complete identification of the operator. The elements to be included cover the legal identity, contact details, and, for registered companies, the identification number.
- Complete identity: company name or first and last name for a sole proprietorship, legal form (SA, Sàrl, etc.), and, if applicable, the IDE number (Swiss business identifier in the format CHE-XXX.XXX.XXX)
- Postal address of the headquarters or main establishment, not just a P.O. box
- Functional email address allowing for direct contact
- For online shops: clear indication of prices (including VAT or excluding VAT with explicit mention), delivery charges, payment methods, and the right of withdrawal if offered
The LCD does not explicitly mention a phone number. However, the email address is mandatory. Some operators add a phone number for transparency, but only the email address is expressly required by the text.
Data protection: what the revised LPD changes for websites
Since September 1, 2023, the revised LPD imposes enhanced information obligations. Any data controller must adequately inform the individuals concerned about the collection of their personal data. This generally involves a privacy statement separate from the legal notices as defined by the LCD.
Data transfers abroad
The use of third-party services (analytics tools, email platforms, CRMs hosted outside Switzerland) may result in data transfers to third countries. The revised LPD then requires indicating the recipient countries and verifying the applicable guarantees. Transfers to the United States receive particular attention from the Federal Data Protection and Information Commissioner (PFPDT).
A site that integrates Google Analytics, a Meta pixel, or a booking tool must document these flows in its privacy policy. The absence of this information constitutes a failure to meet the transparency obligation set by the law.
Sensitive personal data and impact assessment
The definition of sensitive data has been expanded by the revision. In some cases, a data protection impact assessment is required before implementing the processing. Notification of data breaches to the PFPDT is now mandatory when an incident poses a high risk to the individuals concerned.
Sanctions and limits of control under Swiss law
The LCD provides for criminal sanctions for unfair behaviors, including the absence of mandatory notices. Fines can be imposed upon complaint. However, there is no authority that systematically checks the compliance of Swiss websites regarding legal notices.
On the LPD side, the PFPDT has investigative powers and can order measures. Field feedback varies on this point: the effective capacity for control remains limited in the face of the volume of affected sites. The criminal sanctions provided by the LPD primarily target intentional violations of the obligation to inform, the duty of diligence during transfers abroad, or professional secrecy.
The available data does not allow for concluding a high level of actual prosecutions. The main risk for an operator remains the loss of user trust and exposure to civil actions rather than a systematic administrative sanction.
Formatting and accessibility of the legal notice page
The LCD requires that information be presented clearly and completely. Jurisprudence and SECO recommendations guide towards a dedicated page, accessible from every page of the site (link in the footer). Mixing legal notices, general terms and conditions, and privacy policy in a single document harms readability and may pose a compliance issue.
- Separate legal notices (LCD), general terms and conditions of sale (CO), and privacy statement (LPD) into distinct pages
- Make each page accessible in one click from the site footer
- Write in the language of the target audience, ideally in the languages offered on the site
Swiss law does not impose any particular technical format. A PDF document alone, without a visible link from navigation, does not meet the transparency requirement. The page must be indexable, readable on mobile, and updated whenever there is a change affecting the identity of the operator or data processing.
The Swiss legal framework for the mandatory notices of a website relies on the interplay between the LCD and LPD. An operator who addresses these two aspects separately, with clear and up-to-date pages, covers most of their obligations. The real difficulty lies less in the initial drafting than in the follow-up: each new tool integrated into the site, each new foreign provider, can modify the scope of the information to be communicated to users.
