In Sweden, a website may store or read cookies on a visitor's device only after telling them the purpose and getting their consent, unless the cookie is needed to transmit a message or to provide a service the visitor asked for. That rule is chapter 9, section 28 of the Electronic Communications Act (LEK, SFS 2022:482), supervised by the Swedish Post and Telecom Authority (PTS). When cookies collect personal data, the GDPR applies as well, and that part is enforced by the Swedish Authority for Privacy Protection (IMY).
Two authorities, two laws
The Electronic Communications Act (lagen om elektronisk kommunikation, LEK) transposes Article 5(3) of the ePrivacy Directive into Swedish law. As of October 2026, the cookie rule is chapter 9, section 28 of LEK, in force since the 2022 Act replaced the Electronic Communications Act of 2003 and its old chapter 6, section 18. One section now covers both the information and the consent.
The Swedish Post and Telecom Authority (PTS) supervises LEK. The GDPR, which has applied directly in Sweden since 2018, is enforced by Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection.
In practice, a cookie that processes personal data falls under both. PTS deals with storing and reading information on the device, and IMY with what happens to the personal data. A _ga or _fbp cookie set without valid consent can interest both authorities.
What LEK requires: consent before the cookie
Chapter 9, section 28 says information may be stored in or read from a user's terminal equipment only if the user is given access to information about the purpose of the processing and consents to it. Consent has the GDPR meaning: freely given, specific, informed and unambiguous.
Two exceptions apply without consent. Storage or access needed to transmit an electronic message over a network is allowed. So is storage or access necessary to provide a service the user has explicitly requested, such as a session cookie that keeps a shopping basket.
Everything else needs prior opt-in consent. That includes analytics cookies, marketing cookies, social media tracking pixels and any third-party script that reads or writes data on the visitor's device. Pre-ticked boxes do not count.
IMY's cookie banner reprimands
On 30 April 2025, IMY published reprimands against three companies over their cookie banners. All three began with complaints about visits in May 2021, part of a wave of cookie banner complaints coordinated through the European Data Protection Board's cookie banner taskforce, and each decision deals with a different flaw.
| Company | Decision date | What IMY found | Outcome |
|---|---|---|---|
| Warner Music Sweden AB | 4 October 2024 | Not enough information about the right to withdraw consent (GDPR Articles 6 and 7(3)) | Reprimand |
| Aktiebolaget Trav och Galopp (ATG) | 16 December 2024 | Withdrawing consent was harder than giving it, and the banner's misleading design made informed, voluntary consent harder (Articles 6 and 7(3)) | Reprimand |
| Aller Media AB | 28 April 2025 | Cookies on recept.se relied on legitimate interest with no legal basis shown (Article 6(1)(f)) | Reprimand |
The ATG case is the classic dark pattern: accepting took one click, while refusing meant a secondary link and several steps. The Aller Media case is a warning for publishers that label tracking as legitimate interest. The Aller Media decision found no lawful basis and noted that visitors could not object in the first layer.
All three teach one lesson: a "no" must be as easy to find and use as a "yes", both when consent is given and when it is withdrawn.
PTS and IMY: who enforces what
The split between PTS and IMY can look confusing from outside. This table shows which authority covers what.
| Area | Authority | Legal basis |
|---|---|---|
| Storing or reading cookies on a device, and the information about their purpose | PTS | LEK chapter 9, section 28 |
| Validity of consent (freely given, informed, specific) | IMY | GDPR Articles 4(11) and 7 |
| Processing personal data collected through cookies | IMY | GDPR Article 6 |
| Deceptive design in banners | IMY | GDPR Articles 4(11), 7 and 25 |
| Data subject rights (access, deletion, portability) | IMY | GDPR Articles 15 to 22 |
PTS has used its cookie powers sparingly. Its supervision of a small group of companies and public authorities, opened in 2022, ended in 2023 after the organisations changed their practices.
IMY's largest tracking fines came under the GDPR's security rules. On 29 August 2024 it fined the pharmacies Apoteket AB SEK 37 million and Apohem AB SEK 8 million for transferring personal data to Meta through the Meta Pixel (Article 32). The Meta Pixel and cookie consent guide explains how that data leaks.
Cookie banner design rules for Swedish websites
The law, IMY's decisions and EDPB guidance add up to a clear set of expectations for banners shown to visitors in Sweden.
First layer: the banner itself
Give a short, clear description of what the cookies do and why. Accept and reject options belong in the same view, as buttons of equal size and visual weight. Refusing should not take more clicks than accepting.
Second layer: detailed information
A second layer, reached from the banner, lists each cookie category with the cookie names, their purposes and how long they last. The same information belongs in the cookie policy.
What does not count as consent
Pre-ticked boxes, consent inferred from continued browsing or scrolling, and banners that hide refusal do not produce valid consent. The EDPB's Guidelines 05/2020 on consent also say consent is not freely given when access to a website depends on accepting non-essential cookies, which is what a cookie wall does.
How Sweden fits into the Nordic and EU picture
Sweden's approach is close to its neighbours'. Denmark's Datatilsynet and Finland's Traficom apply the same consent-before-cookies model from the same directive, and all three expect opt-in consent for analytics and marketing cookies.
Across the EU, the EDPB's consent guidelines set the baseline and national authorities such as France's CNIL add their own detail. A banner set up for the CNIL's rules usually needs little change for Sweden, apart from Swedish text for a Swedish audience. The global compliance overview shows how the rules line up across countries.
Checklist for websites with Swedish visitors
- Run a cookie scan to find every cookie and tracker on your site, including those set by third-party scripts.
- Separate strictly necessary cookies (exempt) from analytics, marketing and functional cookies (consent required).
- Block non-essential cookies until the visitor opts in: no
_ga,_fbpor similar cookie before a choice. - Give accept and reject buttons the same size and colour scheme, in the same view, with no hidden reject link.
- Put a short description in the banner and the full details (names, purposes, durations) in a second layer or the cookie policy.
- Record each choice with a timestamp and the banner version, and keep the record for as long as you rely on the consent: under GDPR Article 7(1) you must be able to show that consent was given.
- Offer a persistent link or button to change preferences, and say in the banner how consent can be withdrawn.
- If you use Google Analytics or Google Ads, set up Google Consent Mode v2 so the tags follow the visitor's choice.
Questions about cookie consent in Sweden
Does Sweden require consent for Google Analytics cookies?
Yes. Analytics cookies such as _ga are not needed to provide the service the visitor asked for, so chapter 9, section 28 of LEK requires information and opt-in consent before they are set.
Can I use a cookie wall on a Swedish website?
Not if it makes access depend on accepting non-essential cookies. The EDPB's consent guidelines say consent obtained that way is not freely given, and Sweden applies the GDPR's definition of consent.
What fines can Swedish authorities impose for cookie violations?
Under the GDPR, IMY can fine up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Its cookie banner cases so far ended in reprimands, while the Apoteket and Apohem pixel cases brought fines of SEK 37 million and SEK 8 million.
Do I need to show my cookie banner in Swedish?
No law says the banner must be in Swedish, but consent must be informed. If your audience mainly speaks Swedish, a Swedish banner is the reliable way to make sure visitors understand what they agree to.
How long should I keep cookie consent records in Sweden?
No Swedish rule sets a fixed period. Keep each record for as long as you rely on that consent, because GDPR Article 7(1) requires you to show that consent was given.
Show Swedish visitors an equal choice
Kukie.io shows visitors from Sweden a banner in Swedish with Accept all and Reject all side by side, blocks non-essential cookies until they choose, records every choice and lets them withdraw consent from a revisit button at any time.
