In short. Chapter 9 Section 28 requires purpose information and consent for device storage or access, with exceptions for transmission and necessary requested services.
Definition: A Swedish website generally needs to explain the purpose of storing or reading information on a visitor's device and obtain consent before doing so. Chapter 9 Section 28 of Sweden's Electronic Communications Act allows exceptions for transmitting electronic communications and providing a service the visitor explicitly requests.
Key facts
- As of October 2026, the Electronic Communications Act requires purpose information and consent under Chapter 9 Section 28, subject to transmission and necessary-service exceptions.
- The General Data Protection Regulation (GDPR), Article 4(11) defines consent as freely given, specific, informed and unambiguous, expressed through a statement or clear affirmative action.
- PTS's guidance requires separate consent choices for each purpose and equally easy acceptance and refusal.
Which cookies qualify for an exception?
Cookies store information on, or read information from, a device such as a computer or mobile phone. The Act's Chapter 9 Section 28 addresses storage and access to information in terminal equipment, without limiting its wording to cookies.
Alongside the transmission exception, the provision permits storage or access necessary to provide a service at the user's or subscriber's explicit request. PTS's cookie guidance gives shopping basket cookies and access to protected banking services during login as examples. Collecting website statistics because the operator considers them necessary falls outside this exception.
What information and choices must the website provide?
PTS's guidance requires an explanation of each cookie's purpose, which cookies are used, third-party involvement, storage duration and the information collected or used. Visitors must also learn that they can withdraw consent at any time.
Acceptance and refusal must be equally easy, available in the same view, with similarly designed buttons. Visitors must be able to consent separately to each purpose. Until a choice is made, only necessary cookies may be stored.
What makes consent valid and reversible?
Chapter 1 Section 8 of the Electronic Communications Act adopts the GDPR meaning of consent. GDPR Article 7(1) requires proof of consent when personal data processing relies on consent. Under Article 7(2), a written consent request covering other matters must remain clearly distinguishable, intelligible and easily accessible, using plain language. Recital 32 excludes silence, pre-ticked boxes and inactivity as consent.
Article 7(3) allows withdrawal at any time and requires withdrawal to be as easy as giving consent. Withdrawal leaves the lawfulness of earlier consent-based processing intact. PTS recommends a visible button or icon on every page that reopens the banner, or a footer link to a cookie page with withdrawal controls near the top.
Related terms
- Analytics consent gaps
- GDPR lawful basis for web data
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Can I treat continued browsing as consent?
PTS's guidance rejects continued use of a website as consent. Acknowledging that the notice is understood also fails to express consent.
Must I request consent for a necessary shopping basket cookie?
Under Chapter 9 Section 28, storage or access necessary for a service a visitor explicitly requests is permitted without consent. The exception depends on necessity for that requested service.
Sources
- Sveriges riksdag, "Lag (2022:482) om elektronisk kommunikation", issued 19 May 2022
- PTS, "Kakor (cookies)", updated 14 May 2024
- European Parliament and Council, "Regulation (EU) 2016/679", 27 April 2016
Check how a page reads to answer engines. Open the GEO score analyzer