Google Analytics in Switzerland. What the rules are, and when it makes sense to switch
Every website counts its visitors. The question is rarely whether you may do so; the real questions are who else uses the data and how reliable your own figures are. Four questions determine the answer. Three can be checked in your account; the fourth is a business judgement.
Table of contents 11 sections
- Why the Canton of Zurich does not use Google
- What has applied since 15 September 2024
- Question one: who else uses your data
- Question two: who reads your website
- Question three: how reliable your reports are
- Question four: what depends on your data
- When Google Analytics should stay
- Pitfalls, effort and cost
- Two sentences on the market
- What you should know about us
- Taking stock
In short
- Web analytics counts which pages people read. With Google Analytics that counting runs through Google; with a self-hosted tool it runs through a server you control. Both capture the same events but count them by different rules, and they differ in who else may use the data.
- The common claim that Google Analytics is unlawful rests on regulatory decisions from 2022. The central plank of that argument no longer holds: Switzerland has recognised the Swiss-US Data Privacy Framework since 15 September 2024, and Google LLC is certified under it. There is no ban, but the position needs to be kept under review.
- Do not start with the tool. Start by taking stock. Who has access to your account, is data sharing with Google switched on, what is linked to Google Ads, and who receives reports built on your data? Those four answers matter more than any tool comparison.
Got three minutes? Read 'In short', the section 'When Google Analytics should stay' and the stocktake at the end.
The Canton of Zurich explains why it does not use Google
There is a strikingly plain sentence on zh.ch. The Canton of Zurich explains how it measures website use and why it does not use Google's analytics tools: 'For data protection reasons we use no further analytics tools, in particular none from Google.' It measures with Matomo instead, hosted in Switzerland, and with Siteimprove, which the Danish company runs itself.
The federal administration takes a similar line. Its default is Matomo, run by the Federal Office of Information Technology and Telecommunications; the Federal Chancellery runs its own instance on a dedicated server at Metanet AG. Some offices use other tools as well, with processing elsewhere in Europe.
What makes this notable is that both bodies have to justify what they do. It is not evidence that Google Analytics is banned. These are decisions, and the reasons behind them are not the ones you usually hear.
What has applied since 15 September 2024
For this article we read eight pieces published by Swiss agencies and providers. All eight cited the same three decisions: Austria in December 2021, France and Italy in 2022. Their central argument fell away when the Federal Council recognised the Swiss-US Data Privacy Framework, in force since 15 September 2024, under which Google LLC is certified.
That finding comes with three qualifications, and all three are reasons to keep watching.
Only transfers to certified recipients are covered, and Google's own wording is that it relies on the framework 'in certain circumstances'. That Google is subject to US surveillance law was the second argument in the 2022 decisions, and that one has not gone away.
The framework itself remains uncertain, legally and institutionally. The General Court of the European Union dismissed the challenge to it on 3 September 2025, case T-553/23, and the appeal to the Court of Justice was still pending in August 2026. Its predecessors did not survive: both were annulled, in 2015 and in 2020. Since the start of 2025 the US body meant to oversee the redress mechanism has been without a quorum, so it cannot take decisions. The European Commission still treats the framework as applicable, even as MEPs call for it to be suspended.
The Swiss decision is separate and would not lapse automatically because of a ruling in Luxembourg. In 2020, though, Switzerland moved quickly: the Federal Data Protection and Information Commissioner removed the United States from its country list within eight weeks.
The argument in 2022
There was no recognised basis for transfers to the United States, Google was not certified, and regulators treated its use as unlawful.
Correct at the time.The position since 2024
The Swiss-US Data Privacy Framework applies, Google LLC has been certified since 16 September 2024, and transfers to certified recipients are covered.
Correct today, and not settled.A planning note, not a forecast. Switzerland took eight weeks to respond in 2020. A clean migration takes six to twelve weeks, for the reasons set out below, and most of that is waiting. If you start only once something has been decided, you have started too late. None of this says anything about deadlines or fines, and anyone who quotes you a figure for those today has made it up.
Question one: who else uses your data
This is the part the how-to articles skip.
Unlike European law, Swiss data protection law does not require a private company to have a legal basis for every processing operation. A justification is needed only once processing breaches personality rights, and for audience measurement that justification is statistics under Article 31(2)(e). The Federal Data Protection and Information Commissioner, the FDPIC, sets out how to read this in its guidance on cookies. Section 3.8.2 closes with the sentence on which the choice of tool turns:
These requirements can also be met when using external analysis tools, provided that the suppliers of these tools process the data only on the website operator's behalf and not for their own purposes.
Section 3.8.2 sets three conditions before that, and the first is a matter of configuration rather than of provider: the data must be anonymised as soon as the purpose of processing allows, which on a website normally means at once. A self-hosted Matomo stores the full IP address out of the box, so it meets the condition only once someone configures it. The right tool alone is not enough.
Guidance is not binding law, it is the supervisory authority's reading of the law: influential, but neither statute nor judgment. For a view you can rely on in your own case, take proper legal advice rather than read an article.
The key question for this legal route is not where the server sits but what role the provider plays. If it acts only on your instructions, the measurement is justified. If it also uses the data for its own purposes, it is not. The duty to inform and the right to object still apply, and so does the requirement to anonymise.
For analytics data that is not shared, Google acts as a processor and works only on your instructions. The setting that changes this is data sharing with Google products and services: switch it on and Google becomes a controller in its own right for the data shared.
Then there is the link to a Google Ads account. Since 15 June 2026 the use of that data has been governed by the consent mode your website sends to Google. Google Signals, the setting that links your measurement data to signed-in Google users, used to govern it too; it now affects only the behavioural reports. Much of what has been written about Signals is therefore out of date.
With a self-hosted tool the analytics provider drops out of the picture, but the hosting provider does not. It can technically reach the server your data sits on, and the only constraints are your contract and the permissions you grant.
Check before you switch anything off
Switching these settings off is not a risk-free first step. In some setups, advertising audiences and the signals that feed automated bidding rely on them. Record what depends on them in your case first, and get someone to show you how the settings are actually configured today, rather than how a how-to says they should be.
Question two: who reads your website, and from where
Everything above is Swiss law. The fact that your website can be reached from the EU is not enough on its own, or every website in the world would be caught. The EU's General Data Protection Regulation, the GDPR, applies when you target people in the EU or monitor their behaviour, so anyone advertising into the German or French market is within scope. Whether the measurement itself counts as monitoring depends on how you measure. The European Data Protection Board looks at whether the analysis builds profiles. An anonymous, cookie-free count does not automatically qualify; recognising returning visitors by cookie does.
A separate rule then applies. Whether you may place anything on a visitor's device is governed not by the GDPR but by the European cookie rule and by how each country has implemented it. Under that regime, consent is the default, and the Swiss route through statistics does not replace it.
What does that mean for the choice of tool? Two things, and they pull in different directions.
First, for visitors from the EU you will normally need consent, whichever tool you use. Switching on its own does not remove the consent banner.
Second, and this is the exception, some countries exempt pure audience measurement from consent on certain conditions. France does, and the supervisory authority there, the CNIL, cites open-source tools that you configure yourself, Matomo among them, in its practical guidance.
Three qualifications, and the point misleads without them. The exemption depends on how the tool is configured, not on the product. It falls away as soon as you switch on heatmaps, session recording, a user ID or e-commerce measurement, which is to say the very features discussed below. The CNIL replaced its public list of assessed solutions with a self-assessment tool on 1 January 2026, so there is no longer any official endorsement of a product, and the CNIL expressly prohibits presenting a self-assessment as certification. The exemption applies in France only, not across the EU.
In practice, anyone with traffic from the EU runs two checks rather than one. Anyone who does not should at least know that they do not.
Four questions, and none of them is about a ban
Does your provider also use the data for its own purposes? With Google that turns on a single setting, data sharing.
Is your website read from the EU? Then the GDPR applies to those visitors as well.
Some of it is modelled, some is grouped together, and some can no longer be analysed once the retention period runs out.
Ad accounts, reports, exports, audiences. This list is almost always longer than expected, and it drives the work.
Question three: how reliable your reports are
Three characteristics of Google Analytics never turn up in a sales pitch, yet they decide how much weight your reports can carry.
Some of it is modelled. That depends on two things: a consent banner, and counting scripts that load before the visitor decides. Where both apply and there is enough data, Google estimates the behaviour of the visitors who declined from the behaviour of those who agreed. A data quality icon tells you that estimates are involved, but not how big a share of the total they account for. So if you allocate budget by channel share, part of that allocation rests on a model. You see the icon in the reporting interface; in a dashboard passed on to you, often not.
The data quality icon tells you that estimates are involved. It does not tell you how much of the total they account for. In a meeting it is that second number that matters.
Some of it is grouped together. Where a dimension holds a great many different values, Google shows the most frequent and gathers the rest into an '(other)' row. Google's own documentation calls a dimension high-cardinality above 500 distinct values a day. That is expressly not a threshold at which the row appears. The row appears when a report table reaches its row limit. An underrated cause is query parameters in your web addresses: filters, sort orders and campaign tags. A few hundred product pages can produce tens of thousands of distinct values, and the long tail you are measuring for is exactly what disappears.
Some of it expires. The retention period applies to the detailed data at user and event level, not to the aggregated standard reports. How many visits a page had in March 2024 will still be there in three years. What you can no longer ask is what route those visitors took who came in through the pricing page. Two months is usually the default; fourteen months has to be chosen deliberately, and changing the setting later brings nothing back. It is one setting, and it costs nothing to check.
| What | When | What you see instead |
|---|---|---|
| Detailed data at user and event level | after 2 months by default, after 14 months at the maximum of the free edition | standard reports remain; free-form analysis and funnels reach back no further |
| Rare dimension values | when a report table reaches its row limit, made more likely by query parameters. The 500 values are a warning sign, not a threshold | a single '(other)' row |
| Declined visits, with a consent banner and enough data | Google models them | an estimate, flagged by the data quality icon but without a share |
| Declined visits, without those preconditions | nothing is modelled | depending on the setup, little or nothing |
As at 21 August 2026, following Google's documentation. The periods apply to Google Analytics 4 in the free edition; the 360 edition allows longer ones.
Question four: what depends on your data
At almost every company this list is longer than expected, and it drives the work of a migration more than the tool does.
The ad account, reporting tools, Search Console, feeds into your customer database, advertising audiences, automated monthly reports, and everything someone set up once and nobody mentions any more.
One question comes before all the others: does anyone actually read these reports? Check the user statistics for your account. If three people opened it four times in twelve months, the answer is neither Matomo nor Google Analytics but a better measurement plan with three metrics somebody cares about.
When Google Analytics should stay
In these four cases the answer is to stay.
Your automated bidding relies on Analytics. Google Ads measures conversions itself, through the Google tag. But if your bidding currently relies on conversions imported from Analytics, a migration is a project to be planned, not a box to tick.
App and website are analysed together. This is a genuine strength of Google's, but it works through a user ID or the link to signed-in Google users, which is exactly what question one is about.
Nobody will run it. A self-hosted Matomo instance without report archiving configured will slow down, and at worst nobody notices for months that the reports have stopped updating.
Hardly anyone reads the reports. See question four: a migration is then the most expensive way to fix what is really a lack of interest.
One more option will be put to you anyway: server-side tagging. It moves the measurement onto a server you control and captures more visits as a result. It changes nothing for question one, because whoever was using the data for their own purposes still is. It answers the question of measurement accuracy, not the question of role.
Switching makes sense if
- you measure mainly your own website
- you may have to explain your legal basis to a regulator
- you need analysis over periods that exceed the retention limit
- somebody already looks after your servers
Stay, for now, if
- your bidding relies on imported conversions
- app and web have to be analysed together
- nobody will run it
- hardly anyone reads your reports
If you switch: pitfalls, effort and cost
Four pitfalls to address before you switch, and then the cost implications.
The numbers will not match. The two tools count by different rules: when a new session starts, which requests count as bots, and how long a campaign is still credited with a visit. Matomo counts more generously out of the box than Google does. Run both side by side for four to eight weeks under the same conditions. If one sits behind a consent banner and the other does not, you are measuring the consent rate rather than the difference in counting. Switch over afterwards and expect a second increase. That is a real gain, not a measurement error. Measure and explain the difference in advance and you will not have to explain it later.
Your historical data will not transfer intact. Import tools exist, and Matomo offers one itself, but they retrieve processed report values through the programming interface rather than the raw data. Export what you want to keep beforehand, and leave the old account in place with the measurement stopped. The retention period keeps running there, two months by default. The summary figures remain; only the detailed data expires.
Sort out Google Ads first. If conversions are imported from Analytics, switch Google Ads over to measuring conversions itself and collect two to four weeks of data. While both sources are running, conversions will be counted twice unless you temporarily mark the imported conversion as secondary and exclude it from bidding. Compare the two counts during that period and resolve any large discrepancies before you switch, and only then remove the import. Duplicate conversions push bids up, and you will see it in the cost per enquiry before you see it in the report. After each change, allow the bidding system one to two weeks to recalibrate, and do not make the change in your busiest season.
The list from question four of everything that draws on your data determines the length of the project more than the tool does.
What 'free' costs
Matomo, Plausible and Umami all advertise themselves as free if you run them yourself. That holds for the software and for nothing else.
The technical requirements are lower than many expect. Matomo runs on ordinary web hosting with PHP, a database and the ability to run a scheduled task. For a company website with a few thousand visits a month that costs a few tens of francs, and many organisations already pay for it. A dedicated server becomes a question once you reach the limits of your hosting or of the analysis you want, for example when scheduled tasks are not permitted or run times are capped. And as traffic grows: Matomo itself recommends a dedicated server above roughly a million page views a month.
What you still need to allow for: backups with a tested restore, security updates and version upgrades, and report archiving, which has to be configured and monitored. Then the paid extensions for funnels, cohorts and heatmaps. Bought individually they cost less; the 'Team' bundle that packages them together costs EUR 275 a month.
Hosting is the smallest item in this calculation. Leave out the work of running and maintaining the system and your figures will be wrong.
How much work that is depends on your starting point. A single website with the standard reports is a different proposition from several sites, a linked ad account, custom analysis or a data warehouse. Then add everything that depends on question four. There is no single figure here that fits everyone.
So cost the maintenance, not the licence. Add up the items on that question-four list, use the rates that apply in your organisation, whether in-house or external, and work out the running costs over several years rather than over the first.
If you decide to switch We help with taking stock, with running both systems in parallel and with a clean changeover. Which of those you need follows from your own four answers. Matomo web analytics →Two sentences on the market, before we come to tools
Google Analytics is far more widely used than any alternative, Matomo included. Popularity is not a verdict on quality, and it answers none of the four questions.
Besides Matomo, the candidates include Piwik PRO, Plausible, Fathom, Umami and Friendly Analytics.
Three things distinguish them, and those are what to compare. First, how the tool is run: self-hosted or managed by the provider, and whether the provider offers both. Second, where data is stored and processed, which becomes a criterion if your own rules require it to stay in Switzerland. Third, the range of features, where the question is not who offers most but who offers what you actually need after question four.
We deliberately give no prices or feature limits here. They change too quickly for an article to carry them reliably, and an out-of-date price is worse than none. Check them with the providers directly once you have answered the four questions.
What you should know about us
We use Matomo ourselves, on a dedicated server in Germany, configured without cookies, with raw data retained for six months.
Matomo is not our core business. Web analytics is one part of what we do rather than the centre of it, and this article is not a sales brochure for a tool. If you need support with the four questions or with a migration, we will advise you and see the work through with you.
We faced this question ourselves, and our clients face it regularly: is Google Analytics still the right choice? We chose Matomo deliberately, as many others have. What we learned in the process is what we are passing on here.
Take stock before you change anything
How to answer questions one and four
All of it in your existing account, without outside help.
1. Who has access, and with what rights? Google Analytics has two levels, the account and, beneath it, the individual website, called a 'property'. Some of the settings below are visible only with rights at account level.
2. What is linked? Google Ads, Search Console, reporting tools, a data warehouse such as BigQuery. Each is a dependency that has to come with you in a migration.
3. Is data sharing with Google products and services switched on? This is the setting on which question one turns. Record its state and change nothing yet. Record alongside it who configured consent mode on your website and whether Google Signals is active. Signals no longer determines the role, but it does determine whether Google withholds rows in reports that rest on small numbers of users.
4. Which numbers does your automated bidding rely on? Conversions that Google Ads measures itself, or conversions imported from Analytics?
These four answers matter more for your next step than any tool comparison.
Open questions
Not sure what depends on Google Analytics in your case?
The four questions can be answered in your own account, and you do not need us for that. If a decision follows, we will go through it with you in a first meeting, and the answer is often that your Google Analytics can stay. If it goes the other way, we will support you through the migration.
Sources 23 ShowHide
- Supervisory authority. FDPIC, guidelines on data processing using cookies and similar technologies, version 1.1 of 6 October 2025, section 3.8.2, quoted from the official English edition · edoeb.admin.ch
- Law, Switzerland. Federal Act on Data Protection, Art. 31(2)(e) · fedlex.admin.ch
- Law, Switzerland. Telecommunications Act, Art. 45c, duty to inform and right to object
- Authority, Switzerland. Federal Council, recognition of the Swiss-US Data Privacy Framework, decision of 14 August 2024, in force since 15 September 2024 · admin.ch
- Provider. Google, data transfer frameworks, on the certification and on the reservation 'in certain circumstances' · business.safety.google
- Case law, EU. General Court of the European Union, case T-553/23, judgment of 3 September 2025; appeal C-703/25 P before the Court of Justice, pending in August 2026
- Authority, United States. Privacy and Civil Liberties Oversight Board, composition of the board and accountability report for financial year 2025: one member in office, four vacancies, three needed for a quorum · pclob.gov
- Authority, Switzerland. FDPIC, removal of the United States from the country list, 8 September 2020, around eight weeks after the judgment of the time
- Supervisory authority. European Data Protection Board, Guidelines 3/2018 on territorial scope, on when an analysis counts as monitoring behaviour · edpb.europa.eu
- Supervisory authority. CNIL, audience measurement without consent, including the replacement of the public list by a self-assessment tool on 1 January 2026 · cnil.fr
- Provider. Google, data sharing settings: an account-level setting, changeable from the Editor role upwards · support.google.com
- Provider. Google, controller-to-controller data processing terms, on the role when data sharing is active · support.google.com
- Provider. Google, change to Google Signals of 15 June 2026 · support.google.com
- Provider. Google, data retention in Google Analytics · support.google.com
- Provider. Google, behavioural modelling for consent mode · support.google.com
- Provider. Google, high cardinality and the '(other)' row · support.google.com
- Provider. Google Ads, data sources for conversions and avoiding double counting · support.google.com
- Provider. Matomo, system requirements and capacity planning, plus the import from Google Analytics and the prices of the extensions · matomo.org
- Authority, Switzerland. Canton of Zurich, 'How we measure' · zh.ch
- Authority, Switzerland. Swiss federal administration, legal notices · admin.ch
- Survey. W3Techs, market shares of traffic analysis tools, retrieved on 21 August 2026 · w3techs.com
- Our own statement. The raw data retention of our own instance, as set out in the privacy policy of this website
- Note on the quotation. The passage from zh.ch is our translation from the German original. The FDPIC passage is quoted from the Commissioner's own English edition
In digital products since 2002, in Switzerland since 2008. From developer through Scrum master and product owner to head of product, in startups and in large enterprises across insurance, media and telecom. Today hands-on every day with AI agents, LLM workflows and agentic coding.