Web analytics, cookies, tag managers, CMPs, ad pixels, and session-replay tools as deployed on websites and apps targeting Sweden. Sectoral rules (healthcare, banking, employment, telecom) are touched only where they intersect with the analytics layer.
Applicable laws
The legal framework that governs personal data processing here.
National addons
Country-specific statutes layered on the EU baseline.
- Ch 1 § 6 Scope — applies to processing wholly or partly automated; manual processing in structured filing systems
- Ch 2 § 4 Child consent age lowered to 13 for information-society services (lowest tier in EU)
- Ch 3 § 3 Special-category data — Swedish-specific permissions (employment, social security, health, research)
- Ch 6 § 2 Administrative fines — IMY may issue fines against public authorities (capped at SEK 5M for state/SEK 10M for municipalities)
- Ch 9 § 28 Storage / read access on terminal equipment requires prior, informed consent
- Ch 9 § 28(2) Strictly-necessary exception — narrowly construed; analytics/marketing never qualify
- § 19 Email/SMS marketing to natural persons — prior express opt-in required
- § 19(2) Soft opt-in — narrow exception for existing-customer + similar products + opt-out at every contact
- § 21 Telephone marketing — opt-out (NIX-registret) regime for natural persons
- Ch 21 § 7 Personal-data secrecy — disclosure prohibited where it would breach GDPR
- Ch 40 Statistics and research — relaxed disclosure for archived public-sector data
- § 11 Primary negotiation duty — employer must negotiate with union before significant changes (incl. analytics/monitoring deployments)
- § 19 Information duty — continuous information about operations and personnel policy
Regulators
Supervisory authorities that interpret and enforce privacy law here.
Coordination body
- 2021-01-01 · Renaming — Datainspektionen renamed Integritetsskyddsmyndigheten (IMY) to reflect broader privacy-protection mandate beyond data inspection.
- 2023-04 · Cookies guidance update — IMY updated cookie-consent guidance — equal-weight reject button required at first layer; pre-ticked boxes invalid; legitimate-interest unavailable for non-essential cookies under LEK Ch 9 §28.
- 2023-07-03 · Google Analytics enforcement — IMY ordered four companies (Tele2, CDON, Coop, Dagens Industri) to stop using Google Analytics — Tele2 fined SEK 12M (~€1.1M), CDON fined SEK 300K (~€27K); Coop and Dagens Industri were not fined as their supplementary technical measures were considered sufficient. Pre-DPF case (DPF adopted 10 Jul 2023, 7 days later).
- 2024-09 · Workplace monitoring — IMY guidance on employee monitoring — productivity/behavior analytics require GDPR legal basis + MBL § 11 codetermination negotiation with trade unions.
Notable enforcement
Sweden ranks mid-tier among EU member states by GDPR fine volume — well below Ireland, France, and Germany, but consistently active. IMY's pragmatic posture (relative to BW or CNIL) does not translate to leniency on systemic failures: the Klarna, Spotify, Swedbank, and Bonnier cases show consistent willingness to pursue household-name controllers for DSAR mishandling, transparency failures, and access-control weaknesses. The renaming from Datainspektionen to IMY in January 2021 signaled a broader mandate beyond traditional data-inspection. Sweden's child-consent age of 13 (vs Germany's 16) is a notable jurisdictional divergence relevant to any service offering information-society products to minors.
-
Google LLC (right to be forgotten) IMY · Art 17 stood
Inadequate compliance with right-to-be-forgotten requests — Google failed to fully delist URLs after Swedish DPA orders. SEK 75M.
-
Spotify AB IMY · Art 12, 15 reduced-on-appeal
DSAR (Art 15) failures — incomplete access responses to data subjects; insufficient transparency about data origin. SEK 58M (~€5M); on appeal reduced to SEK 40M (~€3.5M) by the Administrative Court of Appeal in 2024.
-
Bonnier News AB IMY · Art 5, 6, eP stood
Unlawful direct marketing — failure to obtain valid consent for marketing emails to subscribers; cross-publication data sharing without legal basis.
-
Swedbank AB IMY · Art 32 stood
Inadequate access controls — internal-system permissions allowed staff to access customer data beyond business need. ~SEK 43M.
-
Tele2 Sverige AB IMY · Art 44, 46 stood
Google Analytics transfers to US — supplementary measures insufficient under Schrems II; SEK 12M. Tele2 had already stopped using GA on its own initiative.
-
Klarna Bank AB IMY · Art 12, 13 stood
Transparency failures — incomplete privacy notice, unclear lawful-basis disclosure across multiple processing purposes. SEK 7.5M (~€700K).
-
MrKoll.se (Bisnode) IMY · Art 5, 6 stood
People-search website — publication of personal data without valid legal basis under Swedish constitutional publishing-licence regime.
-
CDON AB IMY · Art 44, 46 stood
Google Analytics transfers to US — supplementary measures insufficient under Schrems II; SEK 300K. Pre-DPF case (DPF adopted 10 Jul 2023, 7 days after this decision).
GA4 status
GA4 is usable in Sweden with prior, informed consent under LEK Ch 9 §28. IMY did issue a high-profile GA-related ruling on 3 Jul 2023 (one of Europe's first major GA enforcement actions): Tele2 fined SEK 12M, CDON SEK 300K, Coop and Dagens Industri ordered to stop without fines. The decisions covered pre-DPF transfers; after EU-US DPF (10 Jul 2023, 7 days later) transfers to Google's US servers are lawful in principle while Google LLC remains DPF-certified. Controllers should document the consent layer and DPF reliance.
| DPA | Stance |
|---|---|
| IMY | GA4 actionable post-DPF — transfers lawful with DPF + LEK §28 consent. IMY's Jul 2023 GA ruling (Tele2/CDON fines + Coop/Dagens Industri orders) is binding precedent on supplementary-measures sufficiency for pre-DPF transfers. |
Cross-border transfers + Schrems II
Sweden has historically taken a moderate post-Schrems II posture compared to BW or CNIL. IMY accepts adequacy for DPF-certified US importers post-10 Jul 2023. For non-DPF US transfers, IMY expects documented Transfer Impact Assessment and supplementary measures, but does not match the most aggressive German Land DPAs. Swedish controllers benefit from this pragmatic stance — fewer transfer-only fines than peer jurisdictions.
EU 2021/914 SCCs are the fallback when DPF certification is absent or revoked. IMY scrutinizes Module 2 onward-transfer clauses but does not impose German-style mandatory TIA documentation as a default.
Employee data
Key thresholds
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 4 · 0 green · 3 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| YELLOW | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. | |
| YELLOW | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. | |
| YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. | |
| RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. | |
| GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. | |
| GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. | |
| GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. | |
| GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Ad pixels · 3 · 0 green · 0 yellow · 3 red
| Vendor | Status | Rationale |
|---|---|---|
| RED | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. | |
| RED | Schrems II concerns persist; advanced matching hashes PII but does not fix EU→US transfer problem. | |
| RED | PRC-parent ownership flagged by Italian Garante and EDPB; transfers to China contested. Consent + risk acknowledgement required. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. | |
| GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. | |
| YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics legal in Sweden in 2026?
Why was Datainspektionen renamed IMY?
What is the child-consent age in Sweden?
Do I need a DPO in Sweden?
What did IMY's 2023 cookie guidance change?
Do I need to negotiate with a Swedish trade union before deploying analytics?
What language must my privacy notice be in?
Do I need a Swedish Article 27 representative?
Is the offentlighetsprincipen (public access) compatible with GDPR?
Does Schrems II still affect transfers post-DPF?
// EDITORIAL · NOT LEGAL ADVICE This page summarises Sweden's privacy framework as of 2026-05-05. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.