Swedish VPN Retention: Start From the Service Type
Swedish retention rules attach to defined communications services, not to the word VPN. Check the current framework and the actual service before deciding.
Where a VPN company is registered says nothing about which law applies to its service. Retention duties attach to a defined service category and to the provider of that service. Walk the claim in order: current framework, service classification, then the data actually held. Skipping ahead to the label is how old forum answers turn into today's confident misinformation.
Start with the version of the law in force
Older answers on this topic cite Sweden's 2003 Electronic Communications Act as though it were still the whole framework. It is not. The 2022 introduction act put the replacement statute in force on 3 June 2022 and removed the older act from the statute book, leaving transitional provisions in place.
Those transitional provisions are not a technicality. A question asked about events before the change may still be answered under the earlier rules, so the old material is not worthless. It is simply not a description of what applies now, and presenting it as one misleads everyone who reads the summary later. Note the date and version whenever you rely on a legal summary at all.
A conclusion without a date is a rumour with footnotes.
Classify the service before applying a duty
PTS, the Swedish regulator, ties the duty to undertakings that run public communications networks or offer publicly available electronic communications services, and that are subject to notification. That phrasing is a classification test, not a description of every company selling access to a tunnel. Its notification guidance looks at the service actually offered, whether the business transmits signals, the contractual relationship with users, responsibility toward those users, and whether the service is publicly available.
Some over-the-top services fall outside that description, and the guidance distinguishes them from internet-access services. "VPN" is not a category in the analysis; it is a product word covering several business models with different relationships to the user.
So write down what the particular provider supplies. Is it selling an internet connection, an overlay on someone else's access service, additional communications functions, or a combination? That answer, not the company's home address, decides which obligations are even in scope.
| Question | What it settles |
|---|---|
| What service is sold, in whose name? | Whether a notification duty is plausible |
| Who contracts with the user? | Which legal entity carries the duty |
| Is the service publicly available? | Whether the public-service limb applies |
Disclosure and interception are different questions
PTS's retention material separates disclosure of retained information from interception of communications content. Those are distinct measures with distinct legal bases, and a provider statement that addresses one does not answer the other. Mixing them produces arguments where both sides are describing different powers.
Keep statutory retention separate from the provider's own policy as well. Which account records, support tickets or connection metadata does the business process voluntarily, and for how long? A conclusion about one retention duty does not establish that no records exist, and a "no logs" slogan is a marketing claim that deserves the same evidence as any other. Ask which of the two questions a claim is answering before you judge whether the answer is true.
Walk one provider through the questions
Ask in writing for the legal entity that contracts with you, the service classification it claims, the stated basis for its retention position, the categories of data it processes, and the retention period for each. Those five items turn a vague assurance into something checkable. A provider that cannot name the entity or the classification has told you something useful in itself.
Then compare the answers against the current PTS guidance rather than against a blog post citing an act repealed in 2022. Where the classification is genuinely unclear, the honest conclusion is that it needs assessment by PTS or a qualified Swedish adviser, not that a forum thread settled it.
Record the date and scope next to your conclusion. The framework has already changed once, and a statement that was accurate in 2021 should not circulate as a permanent guarantee.
What you end up with is a testable claim: current authority, covered service, required data and separate operational policy. That is more useful than either "all Swedish VPNs log" or "Swedish law cannot touch them".