Summary

• The FDPIC confirmed on 22 October that its 26 June decision against Add Conti was final.
• Investigators rejected the company’s claims that individuals consented to marketing data transfers through online prize draws.
• Add Conti and its contractors must cease unlawful processing and delete the affected records within 30 days of the order becoming final.

Switzerland’s privacy regulator has confirmed a final order prohibiting advertising data company Add Conti from processing or disclosing personal information without valid consent, after investigators rejected its explanation of how marketing records had been collected and found that individuals’ privacy requests went unanswered.

The Federal Data Protection and Information Commissioner (FDPIC) announced the decision’s final status on 22 October. The underlying order was issued on 26 June 2026, following an investigation opened in June 2025 after more than a dozen complaints from people living in Germany.

Those individuals had received advertising from German businesses that identified Add Conti as the source of their contact information. The company maintained that it had obtained the details through online prize draws whose participants agreed to have their information passed to advertising customers.

All the complainants denied entering the competitions or providing the consent claimed by Add Conti. Investigators examined the websites associated with the supposed promotions and concluded that the company’s account was implausible, leaving it unable to demonstrate a lawful basis for the disputed processing.

The order requires Add Conti and its contractors to stop the unlawful activity and delete the information concerned within 30 days of the decision becoming final. Written confirmation must be provided to the regulator. The announcement does not establish that deletion has already been completed.

Prize draw websites failed closer examination

Online competitions can provide a route for collecting marketing information, but the existence of a website and a consent statement does not establish that a particular individual knowingly agreed to a specific use of their details.

The FDPIC examined the prize draw websites cited by Add Conti. It found that the sites generally could be located only by entering their addresses directly, while their visible content consisted largely of legal disclaimers.

The same three competition winners appeared across the pages examined for several months, undermining the company’s explanation that the sites represented genuine sources of the personal information held in its marketing database.

These observations formed part of the regulator’s assessment rather than constituting a general ruling that websites without search engine visibility are unlawful. Their significance lay in the credibility of Add Conti’s account and the absence of convincing evidence linking the complainants to the claimed collection process.

Valid consent depends on more than the ability to point to a privacy notice or general marketing condition. An organisation relying on consent must be able to demonstrate that the relevant person agreed to the processing in circumstances satisfying applicable legal requirements.

For databases assembled from competitions, advertising campaigns or third-party suppliers, evidence may need to establish where information originated, what an individual was told and which uses were covered by the agreement.

The FDPIC concluded that Add Conti had not met the required standard. As the organisation responsible for the processing, the company could not substantiate the consent on which its marketing activity depended.

That finding has consequences for businesses purchasing contact information. A list may be commercially useful and contain accurate personal details, but neither characteristic establishes that the records can lawfully be disclosed or used for a particular advertising purpose.

External contractors did not absorb responsibility

The investigation also examined how Add Conti dealt with people seeking information about its processing or asking for their details to be removed.

According to the regulator, requests for access, deletion and objection sent to the company’s published contact addresses remained unanswered in the cases reported. Individuals were consequently unable to obtain the information or action they had requested through those channels.

Add Conti argued that it had entrusted the handling of these requests to service providers in Germany. The FDPIC rejected that explanation as a defence, finding that the outsourcing arrangement did not remove the company’s responsibility under Article 25 of Switzerland’s Federal Act on Data Protection.

Businesses frequently rely on external providers to maintain databases, manage marketing communications and operate systems for responding to privacy requests. Such arrangements can distribute practical work among several organisations, although the legal responsibilities associated with deciding why and how information is processed remain subject to the applicable data protection framework.

A company may therefore need to demonstrate not only that an external contractor has been appointed, but that requests are received, processed and answered within the required arrangements.

Problems can arise when customer records pass through several organisations. One business may collect an individual’s details, another may maintain the database, and a further company may use the information for an advertising campaign.

Without dependable records about where information originated and who is responsible for responding to individuals, organisations may struggle to establish that their processing is lawful or that affected people can exercise their rights.

Deletion reaches beyond the original company

The FDPIC’s order requires Add Conti and its contractors to stop the unlawful processing and disclosure of personal information for advertising. The affected data must be deleted, and the company must document compliance to the regulator.

The inclusion of contractors is significant because removing information from one company’s principal database may not address copies or records held elsewhere within its processing arrangements.

Organisations carrying out deletion obligations need to identify where information resides and which external parties hold relevant copies. The procedure must account for the actual processing environment rather than assuming that removing a customer entry from one application establishes that all associated records have disappeared.

The regulator decided not to require Add Conti to provide retrospective individual information responses in this case, reasoning that the records were to be deleted. That decision concerned the remedy appropriate to these circumstances and should not be treated as a general exemption from responding to data protection requests.

The FDPIC had also filed a criminal complaint in August 2025 against those responsible for Add Conti over alleged failure to cooperate with its investigation. The complaint was submitted to the public prosecutor in the Canton of St Gallen.

A criminal complaint is not a conviction, and the October announcement does not establish the outcome of criminal proceedings. It concerns the company’s cooperation during the regulatory investigation rather than a finding that every recipient of the disputed advertising data committed an offence.

The regulator further disclosed that bankruptcy proceedings against Add Conti had been initiated with effect from 20 June 2026. That date precedes the administrative order issued six days later.

The announcement provides no confirmed account of how the bankruptcy proceedings affect the execution of the deletion requirement or the management of information retained by contractors.

Swiss enforcement with cross-border consequences

Although the complaints came from people living in Germany and concerned advertising distributed by German businesses, the FDPIC’s investigation addressed the conduct of a Swiss company under Swiss data protection law.

The order should not be described as an EU General Data Protection Regulation penalty or as an enforcement decision made by a German supervisory authority. The relevant legal findings arise under Switzerland’s Federal Act on Data Protection.

Its broader relevance lies in the records used to support consent claims and the responsibilities retained when processing is outsourced across borders.

The final decision demonstrates that a company cannot establish lawful marketing activity merely by asserting that a supplier, competition website or contractor obtained the necessary permission. The regulator examined the underlying collection process, the available evidence and the treatment of the people whose information was used.

Add Conti must now comply with the final order, including documenting deletion of the affected records. Whether that process has been completed, particularly where information is held by external service providers, remains a matter for subsequent confirmation.