Swiss nFADP and browser fingerprinting

What the nFADP says about fingerprinting

Switzerland's revised Federal Act on Data Protection entered into force on 1 September 2023, replacing the 1992 version. The statute is commonly called the nFADP (neues Datenschutzgesetz) or simply the revised FADP. It was designed to align Swiss data-protection law with the EU's GDPR to preserve Switzerland's adequacy status with the European Commission, while keeping certain distinctly Swiss features, most importantly the criminal-sanction model.

The nFADP does not use the word 'fingerprinting'. Article 5(a) defines personal data as 'any information relating to an identified or identifiable natural person'. A browser or device fingerprint, which is a composite identifier assembled from canvas output, font enumeration, GPU renderer strings, AudioContext characteristics, time zone, screen resolution, and similar device signals, qualifies as personal data from the moment a controller uses it to recognise the same visitor across sessions or link it back to a specific natural person. The fingerprint does not need to include a name or email address: the identifiability test under Swiss law, as under GDPR, turns on the ability to single out, not on formal identification.

The Federal Data Protection and Information Commissioner (FDPIC, also EDOB in German and PFPDT in French) has not published fingerprinting-specific guidance as of mid-2026. The FDPIC's general position on online identifiers is consistent with the Article 29 Working Party Opinion 9/2014 and EDPB Guidelines 2/2023: device-level identifiers used to track or recognise individuals across sessions are personal data, regardless of whether a cookie or a passive fingerprint is used to generate them.

Article 19: the proactive notification duty

Article 19 of the nFADP requires controllers to proactively inform data subjects when collecting personal data. The notification must be provided at the time of collection and must cover: the identity and contact details of the controller; the purposes of processing; and, where applicable, the recipients or categories of recipients of the data.

The duty applies even when data is not collected directly from the individual. If a Swiss controller enriches a fingerprint hash with data from a third-party data broker, for example by linking a device fingerprint to a demographic or behavioural segment, Art 19 requires the controller to notify the data subject of that indirect collection and its purpose. This is broader than GDPR Article 13/14, where the indirect-collection notice obligation applies but with a more limited set of prescribed exceptions.

For fingerprinting deployments, Art 19 has two operational consequences. First, the privacy notice or cookie/tracking notice displayed on the site must specifically disclose fingerprinting as a data-collection activity, the purposes for which it is used, and the identity of any third-party fingerprinting vendor. Generic cookie notices that describe only 'cookies and similar technologies' in passing may not satisfy the specificity requirement. Second, if the fingerprint is later used to enrich a profile with third-party data, the controller must assess whether a fresh notification is owed to the individuals concerned.

Lawful bases for fingerprinting under nFADP

The nFADP's framework is structured differently from GDPR. Art 6 sets the general processing principles, including lawfulness, good faith, proportionality, purpose limitation, and data minimisation. The justification grounds for processing private-sector personal data are then enumerated separately in Art 31: consent of the data subject (Art 31(1)(a)), an overriding private interest (Art 31(2)) including specific grounds for contract performance and legitimate-interest balancing, legal obligation, or an overriding public interest. There is no GDPR-style closed list of six lawful bases inside Art 6; the framework instead pairs the Art 6 principles with the Art 31 justification grounds.

Consent under nFADP must be voluntary, informed, and specific. For fingerprinting that goes beyond strictly necessary security functions, consent is the safest basis. Controllers relying on legitimate interest must conduct a balancing test: the interest pursued by the controller must outweigh the interest of the data subject in protection of their personal data. For advertising or analytics-purpose fingerprinting, the balancing test is unlikely to be satisfied without prior notice and an easy opt-out.

Biometric data and genetic data are classified as sensitive personal data under Art 5(c) nFADP. A fingerprint hash derived from canvas, font, and GPU signals is not biometric data in the nFADP sense (which covers physiological or behavioural characteristics that allow unique identification of a natural person). However, if a fingerprinting pipeline incorporates actual biometric signals, such as a voiceprint or typing-rhythm analysis, the sensitive-data rules in Art 34 apply and processing requires explicit consent or another specific ground.

Automated individual decision-making under Art 21

Article 21 of the nFADP grants individuals the right to be informed about automated individual decisions that produce legal effects or significantly affect them. Controllers must disclose that automated decision-making is taking place, allow the individual to express their view, and review the decision on request. This mirrors GDPR Article 22 but applies in the Swiss context.

Fingerprinting is often an input to automated decisions: a device fingerprint score can trigger an account lockout, a payment refusal, a credit-risk elevation, or a content-access restriction. Where the fingerprint feeds directly into such an automated decision, Art 21 obligations apply in addition to the baseline data-collection obligations. Controllers must ensure that the decision logic is disclosed in the privacy notice, that individuals can request human review, and that the underlying fingerprint data can be surfaced on request in response to an access request under Art 25 nFADP.

Data Protection Impact Assessments under Art 22

Article 22 of the nFADP requires a Data Protection Impact Assessment (DPIA) before processing that is likely to result in a high risk to the personality or fundamental rights of data subjects. High-risk processing includes systematic or large-scale monitoring of publicly accessible areas, large-scale processing of sensitive personal data, and profiling that produces a comprehensive assessment of essential aspects of a person's personality.

Large-scale fingerprinting deployments, particularly those used for profiling, cross-site tracking, or automated decisions, are likely to trigger the Art 22 DPIA requirement. The assessment must describe the processing, evaluate necessity and proportionality, assess risks, and document the measures taken to address them. Where residual risk remains high, the controller must consult the FDPIC before proceeding. A DPIA is not made public but must be available on request from the FDPIC.

Cross-border transfers under Art 16

Article 16 of the nFADP governs the transfer of personal data to recipients in other countries. Controllers may transfer personal data abroad without additional safeguards only to countries that the FDPIC has found to provide adequate protection. The FDPIC maintains a public adequacy list at its website. The list broadly tracks the EU Commission's adequacy decisions but is not identical.

For controllers using non-adequate-country processors, Art 16 requires appropriate safeguards. The most common mechanism is standard contractual clauses (SCCs) approved by the Federal Council (Switzerland's specific SCC template, distinct from the EU SCCs, though the two are largely compatible). Other options include binding corporate rules, certifications, or codes of conduct approved under the nFADP.

India, where Benny the Doorman's processing infrastructure is hosted, does not appear on the FDPIC adequacy list as of mid-2026. Swiss controllers who route fingerprint data to Benny must therefore put appropriate safeguards in place, most practically the standard contractual clauses. Benny's Data Processing Agreement (DPA), available on request, incorporates the relevant SCC provisions.

Enforcement contexts under nFADP

The nFADP's criminal-sanction model changes the enforcement landscape compared to GDPR. Rather than a regulator imposing administrative fines directly on an organisation, criminal proceedings under nFADP are initiated by cantonal authorities (the nFADP is a federal criminal statute; prosecutions occur at cantonal level). The FDPIC has supervisory and investigation powers but does not itself impose the CHF 250,000 sanction: it refers matters for prosecution.

The FDPIC's primary enforcement tools are investigation orders (Art 49 nFADP), which can require a controller to provide information, submit to an audit, or cease specific processing, and recommendations (Art 51), which, if not followed, can escalate to a binding decision and ultimately to a referral to the competent court. The FDPIC has published a series of enforcement priorities for 2024 to 2026 that include online tracking technologies, which encompasses device fingerprinting.

As of mid-2026, no concluded criminal proceeding specifically named device fingerprinting as the operative violation. The FDPIC has opened investigations into online tracking practices by Swiss-based publishers and fintech firms, and several have resolved through informal engagement and process remediation rather than formal sanction. Swiss criminal proceedings under data-protection law are rare but not unprecedented under the prior 1992 FADP: the revised law raises the sanction ceiling substantially and is expected to prompt more referrals as enforcement practice matures.

How Benny the Doorman fits into a Swiss nFADP-aware deployment

Benny is a fingerprinting SDK and hosted API. The controller's privacy notice, consent management platform (if relevant), and data processing documentation are separate layers that the controller must put in place before activating Benny.

For a Swiss nFADP-aware deployment, three documentation steps are the minimum. First, update the privacy notice to name fingerprinting as a processing activity under Art 19, specify the purposes (for example anti-fraud, session security, or analytics), name Benny as a processor and sub-processor recipient, and describe the cross-border transfer to India under Art 16. Second, decide and document the lawful basis for each fingerprinting purpose. Anti-fraud use typically rests on legitimate interest under Art 31, with a written balancing test. Personalisation or advertising use requires consent. Third, if the deployment triggers Art 22 (large-scale profiling, automated decisions, or systematic monitoring), complete a DPIA before going live.

On the cross-border transfer point: Benny's processing infrastructure is hosted in Chennai, India. India does not hold an FDPIC adequacy determination. Swiss controllers must therefore execute the Switzerland-specific standard contractual clauses (or equivalent approved safeguard) with Benny before transferring fingerprint data. Benny's DPA, available at benny-the-doorman.com/legal, includes SCC-compatible provisions. Swiss controllers should confirm that the SCC variant they execute covers the Swiss regulatory requirements, not only the EU SCC template.

Benny does not serve as the consent management layer. If a Swiss controller's legal basis for a specific fingerprinting purpose is consent, the controller's CMP must gate the call to Benny's fingerprint API behind a valid consent signal. Benny's documentation describes the API call pattern for consent-gated deployments.