Switzerland: Federal Data Protection and Information Commissioner closed investigation into Digitec Galaxus website personalisation and marketing data processing

On 12 February 2026, the Federal Data Protection and Information Commissioner (FDPIC) concluded its investigation into Digitec Galaxus regarding the mandatory customer account requirement for purchases. The investigation addressed the linking of the ordering process to account creation and the associated data processing, which the FDPIC had previously found in April 2024 to violate the principles of transparency and proportionality under the applicable law. The FDPIC issued formal recommendations, including that Digitec Galaxus revise its data protection declaration to clearly explain the types of data collected, processing purposes, and recipients, provide a guest purchase option, and allow customers to object to the processing of their personal data for marketing purposes. During the review period, the FDPIC monitored the company’s implementation of these recommendations. On 27 November 2025, Digitec Galaxus informed the FDPIC that it had implemented the recommendations, introducing new customer account settings that allow users to enable or disable the collection and use of behavioural data for personalisation. The update includes a one-click option to opt out of website personalisation entirely, with the corresponding cookies automatically disabled. The registration form now explicitly references personalisation and the right to object, and the privacy policy has been updated accordingly.