VPNs with servers in Sweden

Number-independent interpersonal communications services are exempt from the notification duty. Whether a VPN operator is a notified provider, or provides internet access in the Act’s sense, is not established. A draft referral to the Council on Legislation (22 November 2024) proposed extending retention to such services from 1 March 2026; as of December 2025 the government said that more time was needed.

Operators that own a wire carrying signals across the border must also pass those signals to points of cooperation for signals intelligence (chapter 9, section 30). A provider of a prepaid number-based messaging or calling service, or of a prepaid internet connection, must register the subscriber’s name, postal address and identity number first (chapter 9, section 24).

Blocking has come through the civil courts. On 13 February 2017 the Patent and Market Court of Appeal (PMT 11706-15) changed the judgment of the Stockholm District Court and ordered the internet provider B2 Bredband AB (Bredbandsbolaget) to block its subscribers’ access to The Pirate Bay and Swefilmer, under a penalty of 500,000 kronor.

The order covers the listed domain names and web addresses but not IP addresses, and runs for three years from 28 February 2017. The judgment could not be appealed. It binds that provider, for those sites.

The Criminal Code punishes defamation (förtal, chapter 5, section 1; up to two years if gross) and agitation against a population group (hets mot folkgrupp, chapter 16, section 8), which covers threatening or expressing contempt for a group on grounds including race, belief or sexual orientation in a statement or message that is spread: up to two years, and up to four if gross.

A notified provider handing traffic data to the police, the Security Service, prosecutors or another authority acting against crime must do so without delay and in a way that does not reveal the disclosure (chapter 9, section 29 b).

Signals intelligence runs under the Act on Signals Intelligence in Defence Intelligence Operations (2008:717). The signals authority must apply to a court for a permit, granted only if the purpose cannot be met less intrusively and the expected value clearly exceeds the intrusion; a permit lasts up to six months. The Foreign Intelligence Court (2009:966) decides, and a control authority can stop collection or order recordings destroyed that depart from the permit.

In Centrum för rättvisa v. Sweden (Grand Chamber, 25 May 2021, application 35252/08) the European Court of Human Rights held, by 15 votes to 2, that the regime violated Article 8. It accepted the main features but found three defects: no clear rule on destroying intercepted material without personal data, no duty to weigh privacy when sharing intelligence with foreign partners, and no effective review after the fact.

A VPN provider reported that its office in Sweden was searched in April 2023 under a warrant issued at a foreign state’s request. The order of the rows is the security score, and a server’s location is not a recommendation.