Sweden Democrats election texts have prompted around 1,100 complaints to Sweden’s privacy regulator after the party sent political advertising by SMS during the election weekend. The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is now assessing whether to open a formal investigation into how the party processed personal data and whether the campaign complied with the GDPR.
According to Sveriges Radio, IMY’s chief legal officer David Törngren said that any review would focus primarily on the legal basis for the data processing and on the way recipients’ personal information was used.
The Sweden Democrats (Sverigedemokraterna) declined to comment when contacted by Sveriges Radio.
IMY is considering whether to investigate the election texts
The complaints were submitted after political campaign messages were sent by SMS over the election weekend.
At this stage, IMY has not announced that it has opened a formal investigation. The authority is first examining the complaints and deciding whether the case warrants further scrutiny.
Under the GDPR, political parties need a valid legal basis whenever they process personal data in order to send campaign communications. IMY explains that consent can provide such a basis, but parties can in some circumstances also rely on a balancing of legitimate interests.
The regulator says, however, that the scope for doing so is very limited when the recipient is not a party member and has not otherwise shown an interest in receiving political information.
Sweden Democrats have already been reprimanded over political SMS messages
The case is particularly significant because IMY has previously investigated the Sweden Democrats over a similar practice.
In October 2025, the authority reprimanded the party for SMS messages sent ahead of the 2024 European Parliament election.
IMY concluded that the Sweden Democrats had processed personal data without a sufficient legal basis and had failed to provide recipients with the information required under the GDPR. The authority also found shortcomings in the way recipients could exercise their data protection rights.
The case was part of a broader review that also involved Moderaterna. In both cases, IMY concluded that the parties’ interest in spreading political information did not outweigh the recipients’ right to privacy.
The authority said at the time that unsolicited political messages sent directly by SMS or email can be particularly intrusive. It therefore considered the possibilities for political parties to use those channels without consent to be extremely limited when there is no previous relationship with the recipient.
GDPR rules also require parties to explain how personal data is used
The legal issue does not concern political advertising itself, but the personal data processing behind the messages.
According to IMY, political parties must tell recipients why their data is being processed, which legal basis they rely on and what rights individuals have over their information.
The authority has also published specific guidance for political actors on the use of personal data in election campaigns. That includes the selection of voters from databases, the distribution of campaign messages by SMS and social media and other forms of targeted political communication.
These questions have become increasingly important as election campaigns rely more heavily on databases and direct digital contact with individual voters.
The case could further define the limits of digital campaigning in Sweden
The current complaints do not by themselves establish that the Sweden Democrats violated the GDPR.
If IMY decides to investigate, it will have to examine how the telephone numbers and other personal data were obtained, what legal basis the party relied on and whether recipients received the information required by data protection law.
The previous 2025 ruling nevertheless provides a clear precedent. IMY has already established that political parties have only limited room to send unsolicited campaign messages directly to people who have not indicated that they want to receive them.
The new case could therefore further clarify where Swedish regulators draw the line between legitimate political outreach and the protection of voters’ personal data, particularly as parties expand their use of direct and targeted digital campaigning.
