Google Ads and the nDSG: Why Your Landing Pages Are a Compliance Blind Spot
Swiss SMEs pour budget into Google Ads while quietly exposing themselves to nDSG risk and wasted spend. Here's how closed-loop, audit-ready marketing fixes both problems at once.
Most Swiss SMEs treat Google Ads as a marketing problem. It is also a compliance problem — and the two are more connected than they look.
When you run paid search, you are collecting personal data the moment a visitor lands on your page: IP addresses, click identifiers, form submissions, sometimes payment intent. Under the revised Federal Act on Data Protection (nDSG), and GDPR where you serve EU visitors, that data has to be processed lawfully, purposefully, and traceably. Under the Code of Obligations (OR), the leads and revenue that flow from that spend need to reconcile cleanly with your books — not sit in a spreadsheet a marketing agency built for you eighteen months ago and never updated.
Where manual marketing setups create risk
Agencies and freelancers building your campaigns by hand tend to create three recurring problems for Swiss SMEs:
- Landing pages hosted off your domain. Third-party page builders often host your lead-capture forms on their own infrastructure, which muddies who is actually the data controller under nDSG — you, or the tool vendor.
- No record of what happened to a lead. Google Ads shows you clicks and form fills. It does not show you, in an auditable way, which leads became paying customers and which data was collected, stored, or deleted along the way.
- Optimisation for the wrong signal. Because Google Ads only sees clicks and form submissions by default, its bidding algorithm chases the cheapest form fill — not the customer who actually pays. That is not just wasteful spend; it is spend you cannot justify to a fiduciary asking why marketing cost so much relative to revenue booked under your Kontenrahmen KMU.
None of this is exotic risk. It is the everyday reality of running paid search without a system that ties campaign activity, lead data, and revenue together in one place you control.
What compliant, closed-loop marketing actually requires
To be defensible under nDSG and useful under OR bookkeeping obligations, a Google Ads setup needs three things: data processed on infrastructure you own, a clear trail from click to conversion, and a way to prove that what you optimise for is real business outcomes, not vanity metrics.
This is the gap Marketing AI is built to close. Describe your offer, and the AI builds the full Google Ads campaign — ad groups, keywords, ad copy — and generates matching landing pages published under your own domain (/lp/your-company), not a third-party subdomain. That single change already answers the "who is the controller" question that off-domain builders leave open.
Closed-loop attribution, not click-chasing
The more important piece is what happens after the click. Flitz captures the Google click identifier (gclid) for 90 days. When a lead later upgrades to a paying plan, that conversion is pushed back to Google Ads as an offline conversion. Google's algorithm then learns to bid toward leads that become revenue — not just leads that fill out a form. This is the mechanism that turns "we spent money on ads" into a number your fiduciary can actually reconcile against paid invoices and MWST-relevant revenue, instead of an opaque platform metric.
For a business owner, this also means you are not relying on manual exports and guesswork to know whether a campaign worked. The feedback loop is systematic and repeatable, which is exactly the kind of process an auditor or fiduciary wants to see when reviewing marketing spend against booked revenue.
Keyword research and landing pages without a data-sharing detour
Keyword research — seed a term, get AI expansion plus Google Trends and Keyword Planner data — and landing-page generation both run on the same underlying engine as the rest of Flitz, with campaign sync and metrics running on the official Google Ads API rather than scraped or third-party workarounds. You can clone the look of any URL, adjust design tokens, iterate, and preview before publishing single or batch pages. Because everything sits inside the platform you already use for invoicing and accounting, there is no separate vendor relationship, no separate data processing agreement to chase down, and no second system where lead data quietly accumulates without a retention policy.
Social sharing without adding a new data trail
When a landing page performs well, sharing it should not mean opening a fourth tool. Connect your LinkedIn company page and Instagram with one click, and share the page with an AI-drafted caption and card image — from the same place the page was built and the same place its performance is tracked.
The compliance case is the profitability case
Most SMEs overpay Google because they optimise for clicks — the only signal the platform shows you by default. Feeding real revenue back is what makes paid search profitable. It is also what makes it defensible: a single domain, a documented conversion path, and a system where marketing spend, lead data, and booked revenue trace back to one auditable source instead of three disconnected tools.
Compliance and profitability in paid search are not separate goals. They come from the same fix: knowing which leads actually paid, and building your system around that fact.