Quick answer
Mostly yes. Sweden's Marketing Act (marknadsföringslagen) requires prior consent only for marketing email, fax or autodialer calls to a named natural person, under Section 19. A company's own address needs no consent, just a working opt-out under Section 20. Named work addresses sit in a genuine grey area no regulator has settled. GDPR applies on top. This is not legal advice.
What Sections 19 and 20 require
I run cold email and LinkedIn as one sequence for B2B clients, several of them selling into Sweden, and the question I get most from a founder new to the market is whether Sweden works the same as Germany, where the rule reaches every inbox. It does not. The governing statute is the Marketing Act (marknadsföringslag 2008:486), and two sections carry the weight. Section 19's first paragraph says a business may use electronic mail, fax or an automatic calling system for marketing to a natural person only if that person has given prior consent. Section 20 adds a separate, broader requirement that applies no matter who the message goes to: every marketing email must always contain a valid address the recipient can use to ask the marketing to stop.
Put together, that is an opt-in rule for named individuals and an always-on opt-out duty for everyone. There is no volume threshold and no grace period for a first message: the consent Section 19 asks for has to exist before you send, not get collected afterward because nobody complained.
Why a company inbox sits outside Section 19
The phrase that does the real work in Section 19 is "en fysisk person", a natural person. A limited company, a sole trader's registered business name, or a generic department inbox is not a natural person, so the consent requirement does not reach it. Email to sales@foretag.se or info@foretag.se can go out on an opt-out basis from the first message, as long as Section 20's valid stop-address requirement is met every time.
This is the same shape as Norway's rule, which I cover in is cold email legal in Norway, and it is lighter than Germany's, where the consent requirement under UWG §7 reaches company inboxes too. Sweden's law simply never engages for an address that belongs to the organization rather than a person.
What this means for list building. A Swedish list built from department and role inboxes sits outside Section 19's consent rule entirely. The moment a data provider resolves the same companies down to named executives, you are back inside the part of the law that cares who the address belongs to.
The named work address grey zone
Here Sweden differs from its neighbors in a way worth stating plainly, and I would rather say so plainly than paper over it. Norway's Forbrukertilsynet has published guidance stating a named work address still belongs to that individual under Norwegian law. Finland's statute draws its own line in the text itself, Section 200 for natural persons against Section 202 for legal persons. Sweden has neither a court ruling nor a Konsumentverket guidance note that says whether anna.andersson@foretag.se counts as Anna's address or the company's for Section 19 purposes. The closest thing on record is a 2018 answer from the Swedish legal Q&A service Lawline, which leaned toward treating it as the employer's address, but that is one answer from a Q&A platform, not a regulator position, and it predates several years of GDPR enforcement practice that could shift how a court reads it today.
I treat that gap as risk, not permission. A named address gets the benefit of the doubt in some briefs I have seen, on the theory that nobody has been fined for it yet. Absence of enforcement is not the same as a settled legal question, and building a whole Swedish list around an unresolved reading is a choice a client should make with eyes open, not one I make for them by default.
The existing customer exception, condition by condition
Section 19's second paragraph lets a business keep emailing a customer without fresh consent, but only when every condition below holds at once:
| Condition | What it means in practice |
|---|---|
| The address was collected in connection with a sale | A completed purchase, not a demo booking, a webinar sign-up or a form fill |
| The marketing covers the business's own, similar products | An adjacent offering, not the full catalogue and not a partner's product |
| The person has not objected to the address being used this way | One opt-out ends it for good, across every tool sending on the business's behalf |
| The person was told, at collection and in every later message, they can opt out free and easily | The notice has to be there from the first message, not added after the fact |
A cold prospect never clears the first condition, so this exception never rescues a true first touch. It exists for a renewal nudge or an adjacent-product upsell to someone who already bought, not for opening a brand new account.
What Section 21 means for LinkedIn and other channels
Section 21 is the part of the law most guides to Sweden skip entirely, and it matters if your sequence runs LinkedIn next to email the way mine does. It covers "other methods for individual communication at a distance" beyond the email, fax and autodialer list in Section 19, and allows a business to use them unless the natural person has clearly objected. That is an opt-out model, not Section 19's opt-in one, and it applies specifically to methods that reach a person directly and individually, a description a LinkedIn message fits without much argument.
Where Norway has no court ruling on whether a LinkedIn message counts as regulated marketing at all, Sweden's own statute already answers the question by category: a direct message on a platform like LinkedIn falls under Section 21's opt-out rule rather than Section 19's consent rule, named recipient or not. That does not make it risk-free, since a complaint is still a complaint, but it is a meaningfully different starting point from treating every channel as if it needed the same prior consent email does.
Where GDPR and IMY fit in
Sweden is an EU member, so GDPR runs alongside the Marketing Act, enforced domestically by IMY, the Swedish Authority for Privacy Protection. The two laws answer different questions. The Marketing Act decides whether you are allowed to send the message. GDPR decides whether you have a lawful basis to process the contact's email address as personal data in the first place, which for a role-relevant B2B contact is usually legitimate interest under Article 6(1)(f). See is B2B cold email legal in the EU for how that same test plays out market by market.
IMY's own guidance on legitimate interest as a lawful basis treats direct marketing as a use case that can qualify, but only after a documented balancing test weighing your interest in marketing against what the contact could reasonably expect, and it is direct on one point: you must always stop processing the moment the person objects, independent of what the Marketing Act separately requires for sending. Passing the Marketing Act's Section 19 test does not clear the GDPR bar, and passing GDPR does not clear Section 19. A campaign into Sweden has to satisfy both.
What breaking the rule actually costs
Konsumentverket, through Konsumentombudsmannen, supervises the Marketing Act, and intentional or negligent breaches can end up before the Patent and Market Court (Patent- och marknadsdomstolen) as a claim for a marknadsstörningsavgift, a market disruption fee. Section 31 of the Marketing Act sets that fee at a minimum of 10,000 kronor and a maximum of 4% of the business's turnover in the financial year before the breach ended, or, when turnover data is missing or unreliable, a fixed amount of up to 2 million euro. The fee is paid to the state, not the complainant, and a case does not require a court win by the person who received the email, Konsumentombudsmannen can bring the claim itself.
I have not found a published Swedish case applying this specifically to unsolicited cold email, as opposed to telemarketing, which has its own history of enforcement action. That is a reason to read the statute carefully rather than to assume the rule is theoretical. Is cold email legal in Finland covers a documented EUR 7,000 case for exactly this kind of breach next door, which is the more concrete cautionary example of the two.
Sweden next to Finland, Norway and Denmark
Of the four Nordic markets, Sweden and Finland land closest together, both letting a business reach a generic company address without consent, while Norway sets a stricter named-person test and Denmark goes further still. I keep the cost side of this same regional comparison in what B2B outbound actually costs in the Nordics, and the legal picture looks like this:
| Sweden | Finland | Norway | |
|---|---|---|---|
| Consent needed for | Named natural persons (§19) | Named natural persons (§200) | Named natural persons (§15) |
| Company inbox, no name attached | Opt-out only (§20) | Opt-out only, by its own §202 | Outside the rule entirely |
| Named work address | Unsettled, no regulator guidance | Treated as the person's own address | Treated as the person's own address |
| LinkedIn-style direct messages | Opt-out, by §21's own wording | No dedicated rule found | No ruling found either way |
| Maximum fine | 4% of turnover or €2m (§31) | No statutory cap found; EUR 7,000 case on record | 4% of turnover or 25m kroner |
The practical read: Sweden and Finland both treat the company inbox as fair game, which makes a role-address-first list strategy workable in either market without waiting on consent. Where they differ is Sweden's lack of a settled answer on named work addresses, which is exactly the gap Finland's own statute closes by naming legal persons directly in §202.
What actually works when you sell into Sweden
Given where the actual lines sit, here is what I build into a Sweden sequence rather than avoid the market or guess at the rule:
- Start from role and department addresses where the target function has one. Sales, support, info and a named department inbox exist at most mid-size and larger Swedish companies, and a relevant first message to one of those needs no consent, only the Section 20 opt-out line.
- Treat a named address as the higher-risk list, not the default one. Where a data provider resolves a company down to named executives, I weigh the unsettled grey area against the client's risk appetite before including it, rather than assuming it is clear either way.
- Keep the first message short and specific to the role. My own first emails run 30 to 40 words with one concrete problem and one concrete offer, the same shape whether the address is a role inbox or a named contact, which keeps the message inside what GDPR calls relevant processing before Section 19 becomes the separate question of whether you can send it at all.
- Run LinkedIn on the same opt-out logic Section 21 already gives it. A connection request or a message to a named person carries less legal exposure than an email to the same person, under the statute's own wording, which is one reason I run email and LinkedIn as one sequence rather than two separate risk profiles.
- Honor every opt-out immediately, on any channel, the same way the existing customer exception requires it, and keep a record of when and how it happened.
A checklist before you send into Sweden
- Sort each address into role inbox or named person. They carry two different levels of exposure under Section 19, not one.
- For named contacts, weigh the grey area deliberately, rather than assuming either a blanket pass or a blanket ban.
- Put a working stop-address in every message, company or named contact, since Section 20 applies regardless.
- Document the GDPR legitimate interest balancing test IMY's own guidance asks for, before the first send, not after a complaint.
- Treat LinkedIn under Section 21's opt-out model, and still stop the moment someone objects.
- Keep records of consent, objections and opt-outs for every address, the same proof GDPR separately requires.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the statute itself or the regulator's own guidance so you can read the primary source. Have a Swedish lawyer review your specific list and copy before a campaign into Sweden, particularly where named contacts are involved.
Key takeaways
- Section 19 of the Marketing Act requires prior consent only for marketing email, fax or autodialer calls to a named natural person. A company's own address falls outside that rule.
- Section 20 requires a working opt-out address in every marketing email, regardless of who receives it.
- Named work addresses sit in a genuine grey zone: no Swedish regulator has published guidance settling whether they count as the person's or the company's.
- Section 21 covers LinkedIn-style direct messages under an opt-out model, a meaningfully lighter rule than Section 19's consent requirement for email.
- GDPR applies on top through IMY, usually on a legitimate interest basis that still requires stopping the moment someone objects.
- Breaches can reach the Patent and Market Court for a fee of 10,000 kronor to 4% of turnover, or up to €2m if turnover data is missing.
FAQ
Is cold email illegal in Sweden?
Not as a general rule. Section 19 of the Marketing Act bans unsolicited email, fax or autodialer marketing to a named natural person without prior consent. A company's own address, like info@foretag.se, is not a natural person, so that consent rule does not reach it. Every marketing email still needs a working opt-out address under Section 20, whoever it goes to.
Can I email a named person at a Swedish company without consent?
It is unsettled, and not in a small way. Unlike Norway and Finland, no Swedish regulator has published guidance saying whether a named work address, like anna.andersson@foretag.se, counts as the person's own address under Section 19 or as the company's. A 2018 answer from the legal Q&A service Lawline treated it as the company's, but that is not regulator guidance, so I treat named addresses with more caution than generic ones.
Does GDPR add anything beyond the Marketing Act in Sweden?
Yes. The Marketing Act decides whether you can send the message. GDPR decides whether you have a lawful basis to hold and use the contact's email address as personal data, which for a role-relevant B2B contact is usually legitimate interest under Article 6(1)(f). IMY's own guidance says you must stop processing the moment the person objects, regardless of what the Marketing Act requires.
What does a LinkedIn message into Sweden count as under this law?
Section 21 covers individual distance communication methods other than email, fax and autodialers, and allows them unless the natural person has clearly objected, an opt-out model rather than Section 19's opt-in one. A LinkedIn message fits that description, so by the statute's own wording it needs no prior consent, only a stop the moment someone says no.
What happens if a business breaks the Swedish email marketing rule?
Konsumentombudsmannen can bring a case to the Patent and Market Court for a marknadsstörningsavgift, a market disruption fee, for an intentional or negligent breach. Section 31 sets it at a minimum of 10,000 kronor and a maximum of 4% of the business's turnover the previous financial year, or up to 2 million euro if turnover data is missing or unreliable.