Legal Compliance and Data Protection: Google Ads vs. AI Advertising in Switzerland

Google Ads and AI advertising must comply with the GDPR, the new Federal Data Protection Act (DPA), and the Federal Act Against Unfair Competition (FAUC) in Switzerland. Core requirements include transparent data usage, explicit consent for cookies and tracking, and the exclusion of discriminatory algorithms. AI advertising additionally requires labelling of AI-generated content in accordance with the new EU AI Act.

For a comprehensive overview of the entire topic, see here: Google Ads vs. GPT Advertising: The Complete Comparison for Switzerland

Data Protection Fundamentals: GDPR, DPA and FAUC Explained

The legal foundation for advertisers in Switzerland rests on three pillars. The GDPR (General Data Protection Regulation) applies bindingly when the campaign processes data of EU citizens or is controlled from EU servers. The new Federal Data Protection Act (DPA), which has been in force since 1 September 2023, regulates the protection of personal data within Switzerland with modern standards that are similar to, but not identical with, the GDPR. The FAUC (Federal Act Against Unfair Competition) prohibits misleading or deceptive advertising practices – an obstacle that may particularly affect AI-generated content.

A critical distinction: whilst the GDPR follows the principle of "prohibition with permission reserved" (data processing is fundamentally prohibited unless a legal basis exists), the DPA takes a more flexible approach. However, both laws require transparency, purpose limitation and data minimisation. Companies using Google Ads and targeting Swiss or EU users must therefore examine both standards – a compliance gap results in fines of up to CHF 100,000 (DPA) or up to 20 million euros (GDPR).

Google's intermediary role is decisive: Google acts as a data processor or joint controller – depending on contractual arrangement. Here, a lawful data processing agreement (DPA) must be in place that clearly regulates data flows and responsibilities.

Photo: Olena Kholina · Unsplash

Tracking, Cookies and Consent Management in Google Ads

Consent management is the foundation of lawful Google Ads campaigns. Before Google or other advertising networks make users trackable, active, informed consent is required – not silence or opt-out. A functioning cookie banner must meet the following criteria:

• Explicit consent for each tracking category (analytics, marketing, functional)
• Clearly worded privacy policy with specific details on duration and users of data
• Balanced rejection: The "Reject all" button must be as prominent as "Accept all"
• Granular control: Users can selectively accept or reject individual cookie types

The old model of pre-installed or implicit cookies has become legally untenable. Google Analytics and Google Ads pixels in particular require explicit opt-in. Many Swiss websites work with consent management platforms (CMP) such as Borlabs Cookie, Usercentrics or OneTrust to comply with these requirements.

A common error: users are asked for consent, but the banner does not actually disappear – or the reject button is hidden. The Federal Office of Justice and the Data Protection Conference (DPC) have issued clear precedent rulings on this: such "dark patterns" violate the DPA and GDPR and lead to warnings and fines [Source: Federal Office of Justice, DPA Guidelines].

What Data Can Google Ads Collect About Users?

Google Ads collects user data through multiple channels: the Google Ads pixel on the website, search history in Google, YouTube behaviour, device data and location. The central question is: which of this data can be used lawfully?

The DPA and GDPR distinguish between necessary and optional data:

An essential point for Swiss advertisers: Google transfers data partly to the USA, where data protection is less stringent. Data transfer to third countries is only permitted under GDPR and DPA if an adequacy decision exists or standard contractual clauses are embedded. For the USA, this issue has been controversial since the Schrems II ruling [to verify: current status of transatlantic data transfer 2024].

Practical consequence: actively use data minimisation in Google Ads – disable unnecessary tracking parameters and use aggregated data features instead of individual user tracking where possible.

Photo: Maël BALLAND · Unsplash

Transparency Requirements for AI Advertising (AI Act, EU Regulation)

The EU AI Act (Regulation on Artificial Intelligence), which is coming into force gradually from 2024 onwards, creates new obligations for AI-driven advertising. Switzerland is aligned with this regulation, even without formal direct binding.

AI-generated advertising content (text, images, video) must be clearly labelled as such – the FAUC prohibits unfair deception. If a user cannot tell that an advert image comes from DALL-E or Midjourney, that is potentially FAUC-compliant. In practical terms, this means:

• Label "Created with AI" or similar clear identification on advertising content
• Algorithm transparency: if AI segments users or selects discriminatorily, this must be disclosed
• Bias checking: AI must not systematically exclude or disproportionately target certain groups (e.g. by ethnicity, gender, age) from advertising

A concrete example: an e-commerce company uses AI to generate product photos and feed them into Google Ads. This is legally acceptable only if these images are recognisable as AI-generated or disclosed in the product description. Passing them off as "authentic" photos is not permitted under the AI Act and FAUC.

Additionally, transparency requirements demand documentation of training data: what real user data was the AI model trained on? Data protection applies here too: if training data comes from real people without their consent, that violates the DPA and GDPR.

Best Practice: Legally Compliant Marketing in Switzerland

To implement Google Ads and AI advertising in a legally compliant manner, follow this structured approach:

1. Conduct a Data Protection Audit

Review your current infrastructure: what data does Google Ads collect? Are explicit consents in place? Are your privacy policy and cookie banner GDPR and DPA compliant? [to verify: external audits by data protection law firms CHF 5,000–15,000].

2. Implement Privacy by Design

Build data protection in from the outset – not retrospectively. This means:

• Use only the tracking parameters you really need
• Disable automatic advanced matching features in Google Ads if no explicit consent is in place
• Work with aggregate measurement or first-party data instead of third-party cookies

3. Professionalise Consent Management

Use a reviewed CMP that complies with GDPR and DPA. Regularly test whether rejection works as prominently as acceptance. Document all consent decisions.

4. Label AI-Generated Content

If you use AI-generated adverts, label these clearly. Verify training data for legal compliance. Test algorithms for discriminatory effects.

5. Structure Data Processing Agreements Securely

Ensure your Google Ads contract contains a valid data processing agreement (Data Processing Addendum). Google provides this as standard – use it.

6. Documentation and Monitoring

Maintain a record of processing activities (under DPA Art. 12 / GDPR Art. 30). Regularly monitor whether data flows and campaigns remain compliant. Reactive compliance leads to fines – proactive compliance prevents them.

Frequently Asked Questions (FAQ)

Is Google Ads GDPR-compliant in Switzerland?

Google Ads itself is technically GDPR-compliant if you have accepted Google standard contracts and explicit user consent for tracking is in place. The problem often lies with the advertiser: if your website collects data illegally, sets cookies without consent, or transmits user IPs to Google without masking, you – not Google alone – are breaking the law.

What data protection requirements does AI advertising have specifically?

AI advertising is subject, in addition to data protection, to the EU AI Act and the FAUC. AI-generated content must be labelled as such, training data must be lawfully obtained, and algorithms must not have discriminatory effects. Without this transparency, you risk fines for unfair advertising.

Who monitors compliance with data protection in advertising campaigns?

In Switzerland, the Federal Data Protection Commissioner (FDPC) and cantonal data protection authorities are responsible. For GDPR violations (EU users), national data protection authorities in member states monitor compliance. The FAUC is enforced by the Competition Commission (COMCO) and private plaintiffs.

Can I still use third-party cookies in Google Ads?

Third-party cookies have become legally questionable and are being phased out technically (Chrome phased out 2024/2025). Use first-party data, consent-based solutions or Google's Privacy Sandbox tools instead. This is not only more legally compliant, but also more future-proof.

About the Author

[Magnetik expert in digital marketing and data protection compliance in Switzerland with many years of experience in GDPR and DPA compliant campaigns for SMEs and enterprises.]

---

Sources

• Federal Data Protection Commissioner (FDPC) – Guidelines on the DPA
• Federal Office of Justice – Federal Data Protection Act (DPA)
• Google Ads – Data Processing Addendum

---

Your campaigns are only as legally compliant as their implementation. At Magnetik, we help Swiss companies to design Google Ads and AI advertising in a GDPR and DPA compliant manner – without compromising performance. Let us review your compliance together and optimise your strategy. Contact us for a free audit consultation.

← All news