Cookies and consent: what the law requires of a website

The law in one sentence#

Under the Swedish Electronic Communications Act, information may only be stored in or fetched from a visitor's computer or phone if the visitor has been told why and consents, except when it is necessary to deliver the service the visitor has explicitly asked for [1]. The Swedish Post and Telecom Authority (PTS) is the supervisory authority and points out that cookies for statistics do not count as necessary [2].

What a lawful cookie box looks like#

• As easy to say no as yes. A “Decline” choice must be on the same level as “Accept” [2] [3].
• No pre-ticked boxes and no “by continuing to browse you accept” [3].
• Clear information: what is stored, for what purpose, which companies get the data and for how long [2].
• Easy to undo. It must be as easy to withdraw a consent as to give it [4], for example through a link that is always in the footer.
• No misleading design. IMY has criticised companies for cookie boxes that steer the visitor towards “yes” [5].

Google and Microsoft require consent for ad measurement#

Google requires anyone who uses its advertising services in the EEA to have valid consent and to pass the visitor's choice on; without consent signals, personalised advertising among other things disappears [6] [7]. Microsoft has required consent signals for UET since May 2025 [8] and for Clarity from October 2025 [9]. A correct cookie box is therefore not only a legal matter; it is needed for the ad measurement to work.

This is what we do#

• Websites we build set no cookies at all as long as you do not add measurement tools. Then no cookie box is needed.
• If you add a pixel or a tag (see Pixels and measurement), a cookie box is shown with “Accept” and “Decline” equally clear, and the tools load only after a yes. The choice can be changed at any time through the link Cookie settings in the footer.
• The Google and Microsoft tags get the visitor's choice through Consent Mode, and Meta Pixel starts only after consent.
• The privacy policy is updated automatically with the tools and their purpose.
• Regulatory compliance (add-on) also keeps watch on cookie rules and privacy texts on an ongoing basis.

This is an explanation, not legal advice. You are responsible yourselves for how you use the data in the advertising tools [10].