Skip to main content

Switzerland FADP Self-Assessment: Sealmetrics

Reviewed: 12 August 2026. This is a self-assessment; no supervisory authority certifies analytics tools.
Sealmetrics stores no data that identifies a visitor — its only per-visitor value is a session identifier that rotates daily and, once rotated, cannot be reconstructed even by Sealmetrics — and treats that identifier conservatively as personal data under the revised Swiss Federal Act on Data Protection (nFADP / revDSG, in force since 1 September 2023). It stores nothing on the device and meets the information-and-refusal duties of Article 45c(b) of the Swiss Telecommunications Act (TCA/FMG) for the browser properties its tracker reads, and processes data only in Dublin, Ireland — adequate territory under the Federal Council's country list. This self-assessment reviews each FADP duty and the Swiss terminal-equipment rule against that architecture.

Important Notice

This self-assessment follows the published Swiss legal framework and guidance from the Federal Data Protection and Information Commissioner (FDPIC), but does not constitute certification or approval by the FDPIC. This document demonstrates how Sealmetrics meets the applicable requirements when properly configured.

Does the Swiss FADP require a consent banner for Sealmetrics?​

CategoryStatus
Personal data of visitors under FADP✅ Minimal — no persistent identifiers; a session pseudonym kept 1 day, treated as personal data and unrecoverable after daily rotation
FADP processing principles (Art. 6)✅ Compliant
Privacy by design & default (Art. 7)✅ Compliant
Data security (Art. 8)✅ Compliant
Cross-border disclosure (Art. 16–17)✅ EU only — adequate under the Federal Council's country list
Art. 45c(b) TCA — terminal equipment✅ Nothing stored on the device; browser properties read for the session identifier are covered by the information/refusal duties
Consent banner required✅ No
Last Assessment DateFebruary 2026

Background: The Swiss Model​

Switzerland's framework differs from the EU's in two ways that matter for analytics:

  1. No general consent requirement. Under the FADP, processing personal data is generally lawful without consent, provided the processing principles (Art. 6) are respected and personality rights are not unlawfully breached (Art. 30–31). Consent becomes relevant mainly for sensitive personal data, high-risk profiling, or where principles are departed from.
  2. Terminal equipment rule is opt-out, not opt-in. Article 45c(b) TCA permits processing data on third-party terminal equipment if users are informed about it and about how they can refuse — an information-plus-refusal model, not the EU's consent model.

This makes Switzerland structurally more permissive than the EU. Sealmetrics nonetheless assesses itself against the stricter reading on every criterion, because most Swiss customers also serve EU visitors and prefer one uniform standard.

Part 1: Applicability — Is Visitor Data "Personal Data"?​

Criterion 1: Personal data (Art. 5 lit. a FADP)​

Requirement: The FADP applies to data relating to an identified or identifiable natural person. Swiss law follows a relative approach to identifiability: what counts is whether identification is reasonably possible for the data holder with proportionate effort.

Data point storedIdentifiable?
Timestamp✅ No — cannot single out a person
Page URL / referrer✅ No (publishers must not put PII in URLs — see checklist)
User agent (category signal)✅ No — never joined to any identity; the only identifier is the daily session pseudonym below, which identifies no one
Country (from browser timezone)✅ No — country-level only
Session identifier (daily pseudonym, purged after 1 day)⚠️ Treated as personal data — a pseudonym Sealmetrics could recompute while the day's salt exists, though it identifies no person; computed in the browser as a hash of device characteristics, never written to the device, re-keyed on the server with a daily salt destroyed on rotation; cannot recognize a returning visitor across days
IP address✅ Not stored — ephemeral in-memory use for anti-bot protection only

Assessment: ✅ No stored field identifies a person, and neither Sealmetrics nor the publisher can identify one with means reasonably likely to be used. Because the session pseudonym can be recomputed by Sealmetrics for one day, this assessment treats it conservatively as personal data, so the FADP processing principles apply to it — and are met by design: minimal data, 1-day retention, unrecoverable after rotation. Reports are always aggregated.

Honest nuance: identifiability is always assessed in context. If a publisher injected identifying data (e.g., an email in a URL or custom property), the analysis would change. The configuration checklist below exists precisely to keep implementations on the right side of this line.

Part 2: Processing Principles (Art. 6 FADP)​

Even where visitor data falls outside the FADP, Sealmetrics applies the Art. 6 principles as an engineering baseline — and they apply fully to account data (dashboard users' email, name, billing details).

Criterion 2: Lawfulness, good faith, proportionality (Art. 6 paras. 1–2)​

AspectCompliance
Lawful processing✅ Aggregate statistics for the publisher's own audience measurement
Good faith / transparency✅ Documented publicly; privacy policy template provided
Proportionality (data minimization)✅ A small set of non-identifying fields per hit (listed here); no IP stored; country-level geo only

Criterion 3: Purpose limitation (Art. 6 para. 3)​

AspectCompliance
Purpose stated and recognizable✅ Audience measurement only
No secondary use✅ No advertising, profiling, resale, or model training on client data
Provider reuse prohibited✅ Contractually excluded (Terms, DPA)

Criterion 4: Accuracy and retention (Art. 6 paras. 4–5)​

AspectCompliance
Retention limited✅ 24 months for analytics data, then automatic deletion
Account data✅ Deleted within 30 days of account closure; backups purged within 90 days

Part 3: Privacy by Design and by Default (Art. 7 FADP)​

The nFADP made privacy by design and by default a statutory duty — one of the notable additions over the old law.

AspectCompliance
Data protection built into the architecture✅ No cookies, no persistent identifiers, no stored IP — irrespective of configuration
Most protective default settings✅ The consentless, identifier-free mode is the default — and currently the only mode. The one optional feature designed on top of it (Agent Analytics bot detection) is not live and cannot be enabled
Cannot be degraded by misconfiguration alone✅ Individual-level tracking is architecturally unavailable, not merely disabled

Assessment: ✅ Compliant. Sealmetrics is a working example of Art. 7: the privacy properties are structural, not settings.

Part 4: Data Security (Art. 8 FADP)​

MeasureStatus
Encryption in transit✅ TLS 1.3
Encryption at rest✅ AES-256
Access control✅ Role-based access, audit logging, 2FA available
Breach notification readiness (Art. 24)✅ Processes in place; note that stored analytics data contains no personal identifiers, which drastically limits breach impact

Part 5: Cross-Border Disclosure (Art. 16–17 FADP)​

Requirement: Personal data may be disclosed abroad only to countries with adequate protection (per the Federal Council's country list in the Data Protection Ordinance) or with appropriate safeguards.

AspectCompliance
Processing location of analytics data✅ Dublin, Ireland (EU)
Ireland / EU on the Federal Council's adequacy list✅ Yes — EU/EEA states are recognized as providing adequate protection
Transfers of analytics data to the US or other non-adequate countries✅ None
Additional safeguards needed (SCCs, etc.)✅ Not required — disclosure is only to adequate territory

Assessment: ✅ For Swiss publishers, data leaving Switzerland for the EU is a disclosure to an adequate jurisdiction. Analytics data is hosted and processed only in the EU (Dublin), so it is not transferred outside EU/CH-adequate territory. Service emails to account users go through Resend (US) under SCCs. See Subprocessors for the (short) processing chain.

Part 6: Terminal Equipment — Art. 45c(b) TCA​

Requirement: Processing data on third-party terminal equipment (the Swiss "cookie rule") is permitted if users are informed and told how to refuse.

AspectSealmetrics Compliance
Data stored on the terminal✅ None — no cookies, no localStorage, nothing written
Information read from the deviceNo cookies or storage are read; standard browser properties (user agent, timezone, languages, screen resolution, colour depth, display preferences, CPU core count, device memory) are read to compute the session-identifier hash, which is never stored as sent
Information duty✅ Satisfied via the publisher's privacy policy (template below)
Refusal mechanism✅ Standard browser controls / ad blockers; nothing individual to refuse in any case

Assessment: ✅ There is no storage on the device. Reading browser properties to compute the session identifier is processing on the terminal equipment, and the rule's information/refusal duties are satisfied as set out above — no consent is required under the Swiss model.

Part 7: Duties That Do Not Arise (and Why)​

For completeness, the nFADP duties that a Swiss publisher might worry about, assessed against Sealmetrics:

DutyAnalysis
Information duty (Art. 19)Applies to personal data collection; for Sealmetrics, satisfied by a short privacy-policy mention (template below). Recommended regardless of strict necessity.
Right of access (Art. 25)For visitor analytics data, in practice no record can be matched to a requester — the session identifier is unrecoverable after the daily rotation and no persistent identifier exists. See Data Subject Rights. Applies normally to dashboard account data.
DPIA (Art. 22)No high-risk processing: no profiling, no sensitive data, no systematic monitoring of individuals. A DPIA for the analytics function is not indicated; publishers can reference this document in their records.
Records of processing (Art. 12)Publishers should include their Sealmetrics use in their records where they maintain them; this page provides the needed facts.
Profiling / high-risk profiling (Art. 5 lit. f–g)Not performed — nothing is kept that could build a profile across days.

Recommended Privacy Policy Text (German — adapt for FR/IT):

Diese Website verwendet Sealmetrics zur Reichweitenmessung. Sealmetrics
setzt keine Cookies, speichert nichts auf Ihrem Gerät und speichert
keine Daten, die jemanden identifizieren; IP-Adressen werden nicht
gespeichert. Zur Sitzungserkennung liest das Skript Standard-
Browsereigenschaften aus und bildet daraus einen Hashwert, der
serverseitig täglich neu verschlüsselt wird. Diese Sitzungskennung ist
flüchtig: Sie wechselt täglich und kann danach nicht einmal von
Sealmetrics rekonstruiert werden. Die Berichte sind stets aggregiert.
Die Daten werden
ausschliesslich in der EU (Dublin, Irland) verarbeitet — einem Land mit
angemessenem Datenschutzniveau gemäss Verordnung des Bundesrates.
Sie können das Analyse-Skript jederzeit über Ihre Browser-Einstellungen
blockieren.

Part 8: Configuration Checklist for Swiss Publishers​

Required ✅​

  • Standard tracking mode (default configuration)
  • No custom user IDs enabling cross-session tracking
  • No PII in custom event properties or URLs
  • Privacy policy updated to mention Sealmetrics (information duty, Art. 19 FADP / Art. 45c TCA)

Prohibited ❌​

  • Do NOT pass email addresses or other PII as properties
  • Do NOT combine Sealmetrics data with profiling or advertising tools
  • Do NOT export data for individual-level analysis

Part 9: Compliance Statement​

Sealmetrics declares that:

  1. Stored visitor analytics data contains no data that identifies anyone — no persistent identifiers are kept; the only per-visitor value is a session pseudonym re-keyed daily and purged after 1 day, treated as personal data and unrecoverable after rotation
  2. Its architecture satisfies the FADP's processing principles, privacy by design and by default (Art. 7), and data security (Art. 8) requirements
  3. Customer analytics data is processed exclusively in Dublin, Ireland (EU) — adequate territory under the Federal Council's country list — with no transfers outside EU/CH-adequate jurisdictions
  4. Nothing is stored on the visitor's device; the browser properties read to compute the session identifier are covered by the information/refusal duties of the Swiss terminal-equipment rule (Art. 45c(b) TCA), which imposes no consent or banner obligation
  5. On this self-assessment, Swiss publishers can use Sealmetrics for their own analytics without a consent banner when configured per this document

Publishers cannot claim Sealmetrics is "certified" or "approved" by the FDPIC — no such certification exists.

Part 10: Version History​

VersionDateChanges
1.0February 2026Initial self-assessment against the nFADP (in force 1 September 2023) and Art. 45c TCA

References​

Contact​

In short
  • Under the nFADP (in force 1 September 2023) stored visitor records identify no one: no persistent identifiers, no stored IP, country-level geo from the browser timezone, and a session identifier re-keyed daily (live session ~2 hours) that is treated as personal data and becomes unrecoverable after rotation.
  • Analytics data is retained 24 months; account data is deleted within 30 days of closure and backups purged within 90 days; encryption is TLS 1.3 in transit and AES-256 at rest.
  • Processing in Dublin, Ireland is a disclosure to adequate territory under the Federal Council's list, and Art. 45c(b) TCA imposes no consent obligation: nothing is stored on the device and its information/refusal duties are met; this is not an FDPIC certification.
Written and maintained by the Sealmetrics Team