# Cookie consent in Sweden: what the Electronic Communications Act requires > In Sweden, information may be stored in or read from a visitor's device only if the visitor has access to information about the purpose and consents to it, under chapter 9, section 28 of the Electronic Communications Act (2022:482). The Swedish Post and Telecom Authority (PTS) supervises the cookie rule and has ordered sites to make refusing as easy as accepting, while the Authority for Privacy Protection (IMY) fines GDPR breaches linked to tracking, such as 37 million kronor against Apoteket over the Meta Pixel. Source: https://cookiequiet.com/laws/sweden Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Anyone who stores or reads information on the device of a subscriber or user in Sweden: websites, apps, ad and analytics providers - **Consent model:** Opt-in after information about the purpose; GDPR consent standard - **Cookie rule:** Chapter 9, section 28 of the Electronic Communications Act (2022:482), in force since 3 June 2022 - **Authority:** Post- och telestyrelsen (PTS) for the cookie rule; Integritetsskyddsmyndigheten (IMY) for the GDPR - **Maximum fine:** No administrative fine for the cookie rule: PTS orders with a conditional fine (vite), and a criminal fine (böter) for intentional or negligent breaches; GDPR fines up to 20 million euros or 4% of turnover - **Previous rule:** Chapter 6, section 18 of the Electronic Communications Act (2003:389), repealed in 2022 ## Which Swedish law regulates cookies? Sweden transposes Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) in chapter 9, section 28 of the Electronic Communications Act (lagen om elektronisk kommunikation, SFS 2022:482, often shortened to LEK). The act and its introductory act (2022:483) entered into force on 3 June 2022 and repealed the previous Electronic Communications Act of 2003, whose chapter 6, section 18 held the cookie rule before. The provision is short. Information may be stored in or retrieved from a subscriber's or user's terminal equipment only if the subscriber or user has access to information about the purpose of the processing and consents to it. Without consent, storage or access is allowed only when it: 1. is needed to transmit an electronic message over an electronic communications network; or 2. is necessary to provide a service that the user or subscriber has explicitly requested. Consent is read with the [GDPR](/laws/gdpr) definition, which the Directive borrows: freely given, specific, informed, unambiguous, given by a clear affirmative action and as easy to withdraw as to give. ## Which cookies need consent in Sweden? Everything outside the two exemptions. PTS calls them "icke-nödvändiga kakor", non-necessary cookies. Session cookies, shopping carts, login and security cookies, load balancing and the cookie that stores the consent choice fall under the second exemption. Analytics, advertising pixels, A/B testing tools, social media embeds and chat widgets that store identifiers need consent first. Swedish law has no analytics exemption. A first-party statistics cookie is still storage on the user's device and is not necessary for a service the user asked for. PTS made the point in 2023 when it told the Public Health Agency of Sweden that the cookies of its Matomo statistics tool must not be set before the visitor is informed and consents. The only way around consent is a tool configured so that nothing is stored on or read from the device. ## Who enforces cookie rules in Sweden? The split between two authorities is the main thing to know about Sweden. - **Post- och telestyrelsen (PTS)**, the Swedish Post and Telecom Authority, is the supervisory authority under the Electronic Communications Act (section 5 of the ordinance 2022:511). It supervises chapter 9, section 28, including on ordinary websites. - **Integritetsskyddsmyndigheten (IMY)**, the Swedish Authority for Privacy Protection, enforces the GDPR. When the data collected through cookies and pixels is personal data, the processing that follows is IMY's territory. On 7 October 2022, PTS opened a spot check of how a sample of website owners applied the cookie rule. In its decision of 31 October 2023 closing the case against Tele2 (Dnr 22-11378), PTS listed what it had required of the site on 26 June 2023: let users refuse non-necessary cookies as easily as accepting them, at the same moment and in the same view; use colors and contrast that do not favor the accept option; stop setting a named cookie before consent; name the cookie categories on the first layer of the banner; tell users on that layer that they can withdraw consent at any time; and make withdrawal as easy as giving consent. Tele2 made the changes and PTS closed the case without further action. Cases against Swedbank and the Public Health Agency of Sweden were closed the same day on the same terms. ## How high are the fines in Sweden? The cookie rule itself carries no administrative fine. Chapter 12 of the act, which lists the breaches PTS can punish with an administrative sanction fee of 5,000 to 10,000,000 kronor, does not include chapter 9, section 28. Instead: - PTS can issue orders requiring the breach to be corrected, and an order can carry a conditional fine (vite) that becomes payable if it is not followed (chapter 11, section 6); - under chapter 13, section 2, anyone who intentionally or negligently stores or retrieves information in breach of chapter 9, section 28 can be sentenced to a criminal fine (böter), unless the case is minor. The large fines come from the GDPR side. On 29 August 2024, IMY fined Apoteket AB 37 million kronor (case IMY-2022-3270) and Apohem AB 8 million kronor (case IMY-2022-3272) after the Meta Pixel on their websites sent data about customers' purchases to Meta. The breach was a lack of appropriate security measures under the GDPR rather than a cookie consent rule, but it shows what an unreviewed tracking pixel can cost. Apohem's fine was upheld by the administrative court (förvaltningsrätten) on 15 May 2026 and has been appealed to the administrative court of appeal. GDPR fines reach 20 million euros or 4% of worldwide annual turnover. ## What should a cookie banner in Sweden do? PTS's list for Tele2 doubles as a checklist. A banner that follows it: - blocks non-necessary cookies and scripts until the visitor has chosen; - shows Accept and Reject on the first layer, in the same view, with equal visual weight (the [Reject all guide](/guides/reject-all-button) covers the design); - names the categories of cookies on that first layer, with details one click away; - says on the first layer that consent can be withdrawn at any time; - makes withdrawal as easy as consent, for example with a permanent link or icon; - records each choice so you can show that consent was given. ## Does the banner have to be in Swedish? No Swedish law sets a language for private websites' cookie notices. The test is that visitors get information they can understand, and the GDPR requires clear and plain language. For a site aimed at Swedish visitors, that means Swedish. ## How Cookiequiet fits Setting up Cookiequiet takes one script tag and about five minutes: the scan fills the cookie table, Reject all sits next to Accept all on the first layer by default, and the banner is shown in Swedish to visitors whose browser asks for it, among 24 languages. Each choice goes into a consent log, and geo-targeting is included on every plan, [including Free](/pricing). The free [cookie scanner](/tools/cookie-scanner) shows what your site sets, including a Meta Pixel you may have forgotten. ## Questions ### Is IMY or PTS responsible for cookies in Sweden? Both, for different rules. PTS supervises chapter 9, section 28 of the Electronic Communications Act, the cookie consent rule itself. IMY enforces the GDPR for the personal data collected through cookies and pixels, and has issued the large fines. ### Can PTS fine a website for cookies? Not with an administrative sanction fee, because the cookie rule is not in the list of breaches in chapter 12. PTS can order a site to correct its banner and attach a conditional fine to the order. Intentional or negligent breaches can also lead to a criminal fine under chapter 13, section 2. ### Do analytics cookies need consent in Sweden? Yes. The only exemptions are storage needed to transmit a message and storage necessary for a service the user explicitly requested. Analytics is neither, so it needs consent unless the tool stores and reads nothing on the device. ### Does a Reject button have to be on the first layer in Sweden? PTS told Tele2 in 2023 that refusing non-necessary cookies must be as easy as accepting them, at the same moment and in the same view, with colors that do not favor accepting. In practice that means a Reject button next to Accept on the first layer. ## Sources - [Lag (2022:482) om elektronisk kommunikation, Riksdagen (chapter 9, section 28; chapters 11 to 13)](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022482-om-elektronisk-kommunikation_sfs-2022-482/) - [Lag (2022:483) om införande av lagen (2022:482) om elektronisk kommunikation (entry into force 3 June 2022)](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022483-om-inforande-av-lagen-2022482-om_sfs-2022-483/) - [Förordning (2022:511) om elektronisk kommunikation, section 5 (PTS as supervisory authority)](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/forordning-2022511-om-elektronisk-kommunikation_sfs-2022-511/) - [PTS, decision of 31 October 2023 closing the cookie case against Tele2 (Dnr 22-11378)](https://pts.se/contentassets/7b02c828f0984bfba1d1614dc666ab1a/avslutsbeslut-dnr-22-11378-tele22.pdf) - [IMY, supervision of Apoteket AB regarding the Meta Pixel (decision of 29 August 2024)](https://www.imy.se/tillsyner/apoteket/) - [IMY, supervision of Apohem regarding the Meta Pixel (decision of 29 August 2024, court ruling of 15 May 2026)](https://www.imy.se/tillsyner/apohem/)