On 18 September 2026 the Swedish Authority for Privacy Protection opened a review of the mass SMS that two political parties sent before the election, after receiving around 1,500 complaints and tips. Nothing has been decided. The review concerns the legal basis for the processing and how the recipients were selected.
The rule underneath it is not about politics. It governs every company that sends an email or a text message to someone who is not yet a customer, and in Sweden it is stricter than most marketing teams assume. Consent comes before the first message, and a list you bought is not consent.
What Swedish law actually requires
Section 19 of the Marketing Act (2008:486) is the operative provision. A trader may use email, fax or automated calling systems to market to a natural person only if that person has consented in advance. In advance means before the first message, not after it.
Section 20 adds that a marketing email must always contain a valid address to which the recipient can send a request for the marketing to stop. Section 21 covers other methods of individual distance communication — an ordinary telephone call, addressed post — which sit under an opt-out regime instead: they may be used unless the person has clearly objected.
Text messages are treated the same way as email. The channel reaches into the same private space, and Swedish practice has long read the two together.
The customer exception, and its four conditions
Section 19 contains the exception most businesses rely on, and it is narrower than its reputation. Consent is not required where all four of the following hold: the trader obtained the address in connection with a sale to that person; the person has not objected to marketing by email; the marketing concerns the trader’s own similar products; and the person is given an easy opportunity to object on each occasion.
Every condition does work. An address collected from a competition entry or a whitepaper download was not obtained in connection with a sale. A campaign for a different product line is not the trader’s own similar products. And an easy opportunity to object means in every message, not once at signup.
Consent under marketing law is not a legal basis under the GDPR
Two regimes apply at the same time and they ask different questions. The Marketing Act asks whether you may use the channel. The GDPR asks whether you may process the personal data at all, and requires a legal basis under Article 6.
Companies often answer the second question with legitimate interests. That can work for the processing itself, but the balancing is affected by the channel: where marketing law demands prior consent, an interest assessment that concludes you may send anyway is difficult to sustain. Both questions have to be answered separately, and both have to come out in your favour.
What IMY said when it last decided this
On 22 October 2025 IMY decided cases against two political parties over SMS and email sent before the 2022 and 2024 elections. Both received reprimands rather than fines, given the limited and non-systematic scope of the sending.
The reasoning is the part worth reading. The parties argued legitimate interests. IMY found that the recipients’ right to privacy outweighed the senders’ interest in distributing information, and described SMS and email as particularly intrusive forms of unsolicited marketing, pointing to the strong protection the Marketing Act gives that channel. One party’s messages also lacked information on how to unsubscribe.
Why companies have less room than political parties
There is an argument, made by the industry body SWEDMA among others, that political messaging is not marketing within the meaning of the Marketing Act at all, and that only the GDPR applies to it.
If that is right, the consequence runs opposite to most people’s intuition. A political party would face one regime. A company selling a product faces two: the GDPR on the processing and the Marketing Act on the channel. Whatever the answer turns out to be for parties, a commercial sender has less room rather than more, which is why the review is worth a company’s attention even though no company is being reviewed.
Practical example: the Uppsala software company
A software company in Uppsala runs three lists. The first is customers who bought a licence and gave their address at checkout. The second is people who downloaded a whitepaper. The third was bought from a supplier and contains named individuals at target companies.
The first list sits inside the exception, provided the campaign concerns the company’s own similar products and every message carries an easy opt-out. The second does not: a download is not a sale, so a separate consent is needed and the form has to have asked for it clearly. The third has neither consent nor a customer relationship behind it, and buying the list created neither. The supplier’s assurance that the addresses are GDPR compliant says nothing about the Marketing Act, and nothing about a consent the company itself can demonstrate.
Common mistakes
Treating a purchased or scraped list as usable because the seller describes it as compliant.
Reading the customer exception as covering anyone who has ever filled in a form on your site.
Marketing a different product line under an exception that reaches only your own similar products.
Putting the unsubscribe in the welcome message rather than in every message.
Answering the GDPR question with legitimate interests and assuming that settles the channel question as well.
Recommended actions
Sort your lists by how each address was obtained rather than by how the list is used. The origin decides which rule applies.
For every address that relies on consent, check that you can show when and how it was given.
Where you rely on the customer exception, check that the campaign stays within your own similar products.
Put an easy opt-out in every message, and a valid reply address as section 20 requires.
Before buying a list, ask what consent the seller obtained and whether it can be evidenced. If it cannot, you cannot use the list.
Frequently asked questions
Does this apply to B2B email?
Section 19 protects natural persons. Marketing to a company address that identifies no individual is generally treated under the opt-out regime instead. A named individual’s work address is the harder case, and the cautious reading — that a named person is a natural person — is the one to work from.
Can we buy a list of email addresses?
You can buy it. Whether you may send to it is a different question, and the answer is usually no. Consent under section 19 has to be given to the sender, and the individuals also have to be informed under the GDPR. A seller’s compliance assurance does not transfer a consent to you.
Which authority supervises this in Sweden?
IMY supervises the data protection side and is the authority conducting the current review. The Marketing Act is enforced by the Swedish Consumer Agency and the Patent and Market Court. The same campaign can be examined from both directions.
Conclusion
The election SMS made the news because of who sent them. The rule they ran into is the ordinary one, and it applies to every commercial sender in Sweden: consent before the first message, unless the narrow customer exception genuinely fits, with an easy way out in every message that follows.
The work is not in the sending. It is in being able to show, list by list, where each address came from. Companies that can do that have little to worry about. Companies that cannot tend to discover it at the moment someone asks.
If you want a clear picture of which of your lists rest on consent, which rest on the customer exception, and which rest on nothing, we will go through it with you. The first hour is on us.
