FDPIC v Add Conti: anyone relying on consent must prove it

Source: This article is based on the communication from the Federal Data Protection and Information Commissioner (FDPIC) of 22 October 2026, «The FDPIC has prohibited Add Conti GmbH from processing data for advertising purposes and has ordered the comprehensive deletion of such data», and on the order of the FDPIC of 26 June 2026 published there (PDF, in German). Quotations from the order, which is only available in German, are our own translations; «para.» refers to the numbered paragraphs of the order. The analysis is our own and does not constitute legal advice. All sources are listed at the end of the article.

The FDPIC has prohibited Add Conti GmbH from processing personal data for advertising purposes without valid consent and from passing it on to third parties. The company must delete the data both in its own records and at all its contractors, and confirm the deletion with documentation. The order is final.

What stands out is not so much the prohibition as its reasoning. Add Conti GmbH had proof of consent for every address: a completed prize draw form with two ticked boxes, an extract with timestamp and IP address, a delivery report for the SMS confirmation code. On paper, that is what a clean consent log looks like. The FDPIC did not believe it, and its reasons are instructive for every company that obtains consent.

What happened?

According to the commercial register, Add Conti GmbH is active, among other things, in lead generation and list broking, in other words in trading addresses (para. 2). People living in Germany received advertising by phone, post or email from companies they did not know. When they asked those companies where their data had come from, the answer was: from Add Conti GmbH, which had supposedly collected it in a prize draw. In some cases the trail ran through one or two intermediary marketing firms (paras. 6 to 9).

Those who then contacted Add Conti GmbH directly to request access, deletion or an end to the advertising received no reply. In total, the FDPIC received 27 complaints (para. 5).

Date	Step in the proceedings
9 December 2023 to 4 June 2025	15 complaints from data subjects, later 12 more
4 June 2025	The FDPIC opens the investigation
June and July 2025	No answer to the questionnaire, not even within the extended deadline
14 August 2025	Criminal complaint for breach of the duty to cooperate
19 August 2025	Interim order: the managing director is to appear in Bern
29 August 2025	First statement on behalf of the company
18 September 2025	Telephone conversation with the then managing director
February 2026	Statement of facts served for comment, acceptance refused or not collected
20 June 2026	Bankruptcy proceedings opened against Add Conti GmbH
26 June 2026	Order of the FDPIC
22 October 2026	FDPIC communication: the order is final

What did the alleged proof of consent look like?

Data subjects who requested detailed information from the advertising companies received three documents (para. 10):

1. a printout of the prize draw page, filled in with their data, both boxes ticked (acknowledgement of the terms of participation and consent to the data being passed on), the captcha solved;
2. an extract entitled «Stored participant data and proof of advertising consent», with the address of the prize draw, personal data, timestamp of the entry, IP address and timestamp of the verification;
3. a delivery report from a processor in Cyprus, according to which an activation code had been sent by SMS to the number provided.

Form, log, confirmation by SMS: in principle, that is exactly the chain you build for robust proof of consent. That is precisely why it is worth looking at why it did not hold up here.

Why did the FDPIC not believe the proof?

The date. The extract and the SMS report each bore the date of the day on which the access request had reached the advertising company. The FDPIC writes: «There are therefore indications that they were only created by Add Conti GmbH in view of the access request received.» (para. 10)

The inconsistencies. One complainant no longer lived at the address given at the alleged time of consent, and the IP address given had not existed for a year (para. 23). Another is said to have consented at 7.26 am on a Sunday, but their mobile phone is only switched on on working days (para. 24). For a third, the year of birth was given as 1909 (para. 55).

The prize draws themselves. The pages could only be found by entering the address directly. According to the FDPIC, they «look contrived and consist primarily of attempted legal safeguards». For months they had listed the same three winners, and the privacy policy still named the managing director who had left the company at the beginning of 2026 (para. 56).

The bundling. Anyone who wanted to take part was also required to consent to being contacted by sponsors «by telephone, by email and by postal advertising with a view to concluding contracts». Whether anyone would agree to that in order to win a voucher is something the FDPIC considers «at the very least questionable» (para. 57).

The numbers. With 27 complaints following the same pattern, «it can be ruled out that these are isolated misunderstandings» (para. 59). And because each participation had supposedly been confirmed by SMS code, the explanation that strangers had entered other people's data was also ruled out.

The silence. The company did not comment on the facts established and provided no evidence (para. 58).

The FDPIC sums up the outcome as follows: «Add Conti GmbH was unable to prove that it has legally valid consent for the data it collected and passed on.» (para. 60)

Who bears the burden of proof for consent?

The controller. The Federal Act on Data Protection (FADP) does not require consent for every processing activity. But anyone who relies on consent has to prove it. The FDPIC states:

«Under the general rules on the burden of proof in Art. 8 CC, the burden of proving that a ground of justification exists lies with the person relying on the ground of justification, in other words the person processing the data» (para. 53)

In doing so, it refers to a judgment of the Federal Administrative Court of 6 October 2025 (A-2941/2024). For advertising outside an existing business relationship, according to the FDPIC, «voluntary consent obtained in advance and given after adequate information is always required» (para. 53).

For people in the EU, the same rule is expressly laid down in law. Article 7(1) of the General Data Protection Regulation (GDPR) reads: «Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.»

What makes proof of consent credible?

The order does not contain a checklist. But the reasons for which the FDPIC rejected the proof show what proof has to withstand. Our analysis:

1. It is created at the moment of the decision. A log that is only put together on request is not a log. The entry should be created automatically, with the server's timestamp, at the instant the person clicks.
2. It remains unchanged. Exports and extracts come from the running log and bear its timestamp, not the date of the export.
3. It records what was consented to. Which categories, which text, which recipients. Consent «for advertising» without reference to a specific purpose carries little weight.
4. It matches the route by which the data arrived. Anyone collecting addresses through a form should be able to show how people got to that form in the first place. A page that nobody can find does not explain thousands of entries.
5. It records refusal and withdrawal just as it records acceptance. Otherwise it only documents half the story.
6. It is not kept longer than necessary. How long that is, we explain in our article on consent log retention.

For cookie consent at Aiara, the banner takes care of this: every acceptance, refusal and withdrawal is logged at the moment of choice, with time, action and selected categories. We store the IP address only as a hash value, never in plain text. For every completed month, an archive of consents is available as a CSV file. The same principle applies to newsletter, prize draw or lead consent; there, the form or mailing system has to deliver it. What a clean double opt-in looks like is explained in our article on sending newsletters in Switzerland.

What applies to access, deletion and objection requests?

Here the case was clear-cut. Twelve data subjects had written to Add Conti GmbH at the published email addresses, seven by registered letter. Not a single reply (para. 46). At least 13 had objected to the processing or requested deletion, likewise without any response (para. 51).

Information within 30 days. Anyone requesting information under Article 25 FADP must in principle receive it free of charge and within 30 days. The FDPIC stresses that the controller must «establish internal processes» for this (para. 44).

Deletion without a deadline, but promptly. The law sets no deadline for deletion requests. The FDPIC nevertheless holds that the controller must examine them «promptly», because otherwise it processes data against the declared will of the person, which constitutes an unlawful breach of privacy under Article 30(2)(b) FADP (para. 49).

Excuses do not count. The company explained that its managing director travelled regularly between Asia and Europe, that a deputy first had to be found, and that German email providers filtered many messages out as spam (paras. 14 and 15). Since October 2025, the FDPIC has received five further complaints with the same content.

Outsourcing does not release you. The requests had allegedly been handled by a service provider in Hamburg and a data protection advisor in Krefeld. According to the managing director, there was not even a written contract with the service provider (para. 42). The FDPIC's view:

«Although it may contractually assign specific tasks to third parties, it remains legally responsible for providing information under Art. 25 FADP within 30 days, for ensuring that objections are implemented and for ensuring that data is only processed lawfully.» (para. 43)

In practice, this means that every contact address listed in the privacy policy has to be read by someone, including during holidays. Letters, emails and calls belong in one place, with the date of receipt and the end of the deadline. That is exactly what data subject request management in Aiara Pro is for: a form in four languages, manually recorded letters and emails in the same list, the 30-day deadline from receipt, and reminders to your team seven days and one day before expiry. You write the reply to the person yourself.

Does the FADP also apply if only people abroad are affected?

Yes. All of the complainants lived in Germany, and the advertising companies were based there. According to the FDPIC, this is not decisive for the applicability of the FADP: what matters is that the responsible company has its registered office in Switzerland and that a relevant part of the processing takes place here (para. 37). The FDPIC writes that Switzerland should «not become a safe haven for data processing that has no domestic effect because, for example, only information about persons resident abroad is processed from Switzerland».

For Swiss companies with customers abroad, this is the flip side: anyone processing from here is subject to Swiss supervision and, depending on the offering, to the GDPR as well. We explain the difference between the two frameworks in our article FADP and GDPR compared.

What does the case mean for companies that buy addresses?

The order is addressed only to Add Conti GmbH. The facts, however, reveal a chain: the advertising companies in Germany named Add Conti GmbH as the source, sometimes via other traders. Anyone who buys addresses or leads thereby takes on the question of whether they were collected lawfully. If a data subject asks, the buyer must, among other things, provide the available information on the origin of the data (Article 25(2)(e) FADP).

Our analysis: anyone relying on consent obtained by someone else should, before buying, ask to be shown how that consent comes about, and be able to retrieve proof for each record that is not generated only on the day of the enquiry. Proof that falls apart at the first close look protects the buyer as little as the seller.

What were the consequences of the proceedings?

• Prohibition and deletion. Processing and disclosure for advertising purposes must cease; the data must be deleted at the company and all its contractors within 30 days of the order becoming final, and the deletion must be confirmed to the FDPIC with documentation. The FDPIC has refrained from ordering the retrospective provision of information, as the data must be deleted in any case.
• Threat of penalty. The order was issued with reference to Article 63 FADP. Anyone who wilfully fails to comply with it is liable to a fine of up to CHF 250,000. Under Article 29 of the Swiss Criminal Code, it is the natural person within the company who should have ensured compliance that is liable to punishment (para. 65). How fines under the FADP work is explained in our article on data protection fines in Switzerland.
• Fee. The FDPIC is charging for its work: 26.75 hours plus expenses, totalling CHF 6,456 (para. 68).
• Criminal complaint. Because of the breach of the duty to cooperate, the FDPIC had already filed a criminal complaint against the responsible bodies with the Public Prosecutor's Office of the Canton of St. Gallen in August 2025. Nothing is known about the outcome. The accused are presumed innocent.
• Bankruptcy. According to the FDPIC, bankruptcy proceedings were opened against Add Conti GmbH with effect from 20 June 2026.

What companies should check now

1. Where do our advertising addresses come from? For each source, clarify the basis on which the processing relies and, for purchased addresses, document their origin.
2. Can we prove every consent? A log that is created at the moment of the decision and cannot be altered afterwards.
3. Is the consent voluntary and specific? No mandatory boxes that bundle participation and advertising, and clearly named purposes and recipients.
4. Are the contact addresses being read? Every address in the privacy policy ends up with a person who deals with it, with a deputy.
5. Are we meeting the 30 days? Record the date of receipt, make the deadline visible, send a reminder before it expires.
6. Do we implement objections and deletions promptly? Including at contractors, with a written contract and proof of deletion.

---

Aiara is a Swiss provider of cookie banners, consent records and legal texts. This article summarises the FDPIC's communication and order and puts them in context. It does not replace legal advice in individual cases.

Sources

• FDPIC, communication of 22 October 2026: «The FDPIC has prohibited Add Conti GmbH from processing data for advertising purposes and has ordered the comprehensive deletion of such data», accessed on 28 October 2026
• FDPIC, Verfügung vom 26. Juni 2026, Add Conti GmbH, Adressdatenbank für Werbezwecke und Betroffenenrechte (PDF, in German), final
• FDPIC, communication of 21 August 2025: «FDPIC files criminal complaint against Add Conti GmbH for failure to cooperate in an investigation»
• Federal Act on Data Protection (FADP), SR 235.1