GDPR
General Data Protection Regulation
The GDPR applies to Swiss companies too — as soon as you address people in the EU. Aiara implements the requirements for consent, transparency and provability in full.
GDPR at a glance
- In force
- Since 25 May 2018
- Supervision
- National data protection authorities
- Penalty
- Up to EUR 20 m or 4 % of global turnover
- Model
- Consent before setting (opt-in)
What is the GDPR?
The General Data Protection Regulation governs across Europe how personal data may be processed. It requires a legal basis for every processing operation, mandates transparency and gives data subjects enforceable rights.
For cookies and tracking the ePrivacy Directive applies on top, implemented nationally in each member state — in Germany, for instance, through the Telecommunications Digital Services Data Protection Act. The practical consequence is the same everywhere: without prior consent, only strictly necessary cookies may be set.
Who does the GDPR apply to?
An establishment in the EU
Anyone with an establishment in the EU falls under it, regardless of where the data is processed.
Offering goods or services in the EU
The marketplace principle in Article 3 also captures Swiss companies offering goods or services in the EU — recognisable by prices in euros, an EU language version or delivery into the EU.
Monitoring behaviour
Anyone monitoring the behaviour of people in the EU, for instance through analytics or advertising tracking, falls under it as well — even without selling anything there.
What does the GDPR require of a website?
Consent before the first cookie
Non-essential cookies and scripts may only load after the person has agreed. Pre-ticked boxes and continued scrolling do not count as consent.
Refusing as easy as accepting
Both options must sit on the same level and be equally prominent. An "Accept all" button next to a hidden settings link is not permissible.
Granularity by purpose
Consent must be grantable per purpose — analytics separately from marketing, not as a bundle.
Withdrawal at any time
Withdrawing must be as easy as granting. In practice that means permanently reachable access to the settings.
Provability
You must be able to demonstrate who consented to what and when. Without a record, consent is worthless in a dispute.
Complete information
The privacy policy has to name purposes, legal bases, recipients, retention periods and data subject rights — specifically, not as boilerplate.
How does Aiara meet the GDPR?
Aiara does not treat GDPR compliance as an add-on but as the default state — every domain starts compliant.
Scripts load only after agreement
The banner blocks analytics and marketing scripts as well as embedded content such as maps and videos until consent is present. Embedded services get a placeholder with an activation button.
Equal buttons out of the box
"Accept all" and "Reject all" sit on the same level, in the same size and weight. That cannot be accidentally broken in the designer.
Four categories, individually switchable
Necessary, functional, analytics and marketing — each with its own switch and a cookie list naming provider, purpose and retention period per entry.
Consent record as evidence
Every decision is logged with timestamp, identifier and scope, and can be exported as evidence. After 24 months detail records are condensed into monthly summaries.
Privacy policy from the questionnaire
Your answers produce a complete policy with legal bases under Article 6 — versioned, so earlier wordings remain provable too.
Withdrawal always within reach
A permanent entry point reopens the settings. Withdrawal takes effect immediately: scripts are unloaded, cookies already set are removed.
Want to understand the legal position in detail rather than the solution? The guide covers scope, legal bases and data subject rights at length.
Read the GDPR guideFrequently asked questions about GDPR
Official sources
This page summarises the legal position in plain language and is no substitute for legal advice.