Cookie banners cost about half the analytics data in German-speaking Europe, because on average only around half of visitors consent. Part of that loss is legally required, part is self-imposed: the revised Swiss Federal Act on Data Protection (revFADP) has no general cookie consent requirement of the kind the EU has through the ePrivacy Directive. It requires transparency, and consent for particularly sensitive data or high-risk profiling. As soon as a site also has EU visitors, the GDPR applies as well. Without consent, consent mode delivers only modelled values, so estimates rather than counts. Without a banner, server-side analysis of the access logs works, because it records at delivery, sets no cookies and needs no JavaScript.
A banner is a compromise, and like every compromise it costs something. With analytics it costs about half.
It gets interesting when you work out which part of that price is legally required and which part is self-imposed. For Swiss companies the second part is often larger than assumed.
What the banner costs
With a properly designed banner, meaning one where declining is as easy as accepting, about half of visitors in German-speaking Europe consent. The other half does not appear in Google Analytics, and that is precisely the intent of the rule.
Two further losses come on top, unrelated to the banner:
- Safari and Firefox block tracking out of the box, with no action from anyone.
- Content blockers, corporate proxies and DNS filters stop the script from loading at all.
The number in Analytics is therefore not a measurement but a lower bound. In practice, actual traffic is often two to three times higher.
What Swiss law actually requires
The difference is worth looking at, because it is regularly overlooked in practice.
In the EU, it is not the GDPR alone but the ePrivacy Directive that governs access to end devices. It requires consent before cookies that are not technically necessary are set or read. Analytics cookies do not count as technically necessary. Hence the banner.
In Switzerland there is no such provision. The revised Federal Act on Data Protection primarily requires transparency: the processing must be recognisable, the privacy notice understandable and complete. Explicit consent is needed for particularly sensitive personal data and for high-risk profiling, not blanket consent for every analytics cookie.
That does not mean Swiss sites need no banner. As soon as a site also has visitors from the EU, and almost all do, the GDPR and ePrivacy apply to those visitors. The banner is then the simplest way to satisfy both at once.
It does mean that how the banner is configured is a real question with more than one answer. Anyone installing a standard banner that blocks all measurement for everyone may have switched off more than their audience requires.
And because this is easily misread: this is not legal advice, it is the description of a difference. How it applies to a specific site belongs in front of a lawyer, not decided by an architect.
What realistically remains after consent
Anyone using consent mode still measures something without consent, but differently than many assume.
Without consent, Google sends only cookieless signals without identifiers. From those signals and the behaviour of the consenting half, Google models the missing values. What appears in the reports is then partly an extrapolation.
For a trend that is often usable: if the curve rises, it probably really is rising. For reliable absolute numbers it is not, and for the question “did this one campaign work” it is delicate, because modelling is least certain exactly where the case numbers are small.
Anyone deriving decisions from modelled numbers should at least know that.
The layer that needs no banner
There is one measurement unaffected by all of this, because it sits somewhere else entirely: the access logs of the server or the CDN.
Every request is recorded there the moment it is served. Before the banner. Before JavaScript. With no cookie and no identifier in the browser. It is no alternative to Analytics for behaviour, paths and goals, but it is the only source that says who was there at all.
Two things belong with that:
This is personal data processing too. An IP address is personal data, even if it only sits in a log briefly. So it needs truncation or a short retention period, a clean entry in the privacy notice and, with a processor involved, a data processing agreement. What it does not need is the consent from the banner dialogue, because no access to the end device takes place.
Logs have to be read properly. On my own site, over 31 days, 27 percent of traffic was a single monitoring tool and 30 percent were requests with no identifier at all. And of the visits presenting themselves as AI systems, only a minority survived a check against the published IP ranges. Reporting those numbers unfiltered as visitors is just as wrong as a broken Analytics, only in the other direction. How to separate them is in the post on AI crawlers in server logs.
What I recommend
The two layers are not competitors, they answer different questions.
Keep Analytics for behaviour, paths through the site and goal completion, knowing that the absolute numbers are a lower bound and part of them is modelled.
Put the server side next to it for the question of who came at all, including the systems that never show up in Analytics.
And have the banner properly reviewed once, instead of treating it as given. A banner stricter than necessary costs you data without anyone being better protected. A banner that is too loose costs more if it comes to it. Both are legal questions, and both are cheaper to clarify than to ignore.
Frequently asked questions
Do you need a cookie banner for Google Analytics in Switzerland?
The revised Swiss Federal Act on Data Protection has no general consent requirement for cookies of the kind that applies in the EU through the ePrivacy Directive. It requires transparency, meaning an understandable privacy notice, and consent for particularly sensitive data or high-risk profiling. As soon as a site also has visitors from the EU, however, the GDPR and ePrivacy apply to them, and consent for analytics cookies is then the usual route. This is not legal advice; the specific setup belongs in front of a lawyer.
How many visitors are lost to the cookie banner?
In German-speaking Europe, with a properly designed banner, about half of visitors consent on average. That half is missing from Google Analytics entirely. On top come Safari and Firefox, which block tracking out of the box, plus content blockers. The reported number is therefore not a measurement but a lower bound.
What does consent mode still measure without consent?
Without consent, Google sends only cookieless signals without identifiers, from which it models the missing values. What appears in the reports is then partly an estimate rather than a count. That can be enough for a trend, but not for reliable absolute numbers.
Which measurement works without a cookie banner?
Server-side analysis of the access logs. It records every request at delivery, before any banner and without JavaScript, and needs no cookies. Personal data is involved through the IP address, so it needs truncation or short retention and an entry in the privacy notice, but not consent in the sense of the banner dialogue.