Is Google Analytics illegal in Sweden in 2026?

The question comes up in almost every procurement meeting: "Are we allowed to use Google Analytics?". The answer is not yes or no, it depends on what kind of organization you are, which sector you work in, and what risk appetite you have. This article goes through the legal situation as of May 2026.

Summary for those in a hurry

• Private Swedish companies: Google Analytics 4 is technically legal via the EU-US Data Privacy Framework (DPF), but legally fragile. A cookie banner is mandatory under ePrivacy.
• Municipalities and regions: The Swedish data protection authority (IMY) recommends avoiding GA4. Many municipalities have already switched. The Schrems II uncertainty weighs more heavily than the convenience.
• Healthcare, schools, childcare: Switch away. The risks outweigh the benefits when handling special categories of personal data.
• SaaS companies with EU customers: Your choice affects your customers’ compliance. Many B2B customers will ask whether you have moved away from GA4 in their vendor questionnaires in 2026.

Timeline: Schrems II and DPF

To understand why this is complicated we need to go back to 2020. The Court of Justice of the EU then invalidated Privacy Shield, the agreement that previously governed data transfers between the EU and the US. The ruling is called Schrems II and it established that US legislation (in particular FISA 702) gives US intelligence services broad access to European personal data, too broad for DPF-like arrangements to suffice.

Between 2020 and 2023, using GA4 in the EU was in a legal grey zone. Several supervisory authorities (Austria, France, Italy, Denmark) judged GA4 to be illegal during this period.

In July 2023 the EU-US Data Privacy Framework (DPF) entered into force as a replacement. Google self-certified under the DPF, which provides the current legal basis for data transfers. It is still the legal basis today, May 2026.

Max Schrems (the same lawyer who brought Schrems II) has filed new legal challenges against the DPF. It will probably be called Schrems III if the Court of Justice of the EU takes it up, and is expected to be decided within 2 to 4 years. If the DPF falls, we are back in a legal grey zone.

What does IMY say in 2026?

The Swedish data protection authority (IMY) has not issued a blanket ban on GA4 after the DPF entered into force. However:

• IMY has explicitly recommended that public bodies (municipalities, regions, government agencies) should seek EU-based alternatives.
• Supervisory cases about cookie banners remain one of IMY’s most common focus areas. An incorrectly implemented cookie banner is itself a GDPR breach, regardless of what the analytics service does with the data.
• When handling special categories of personal data (health, ethnicity, religion, sexual orientation, children) the bar is significantly higher.

The real cost of keeping GA4

GA4 is free. The real cost is paid in other currencies:

1. Cookie banner friction

GA4 sets cookies. Cookies require consent under ePrivacy. Cookie banners reduce conversion and ruin UX. Studies have shown that 30-60% of visitors reject cookies, which means that a large share of your traffic is not even counted in GA4.

2. JavaScript weight

The GA4 script is around 70 KB minified and gzipped. It loads in your page head and can delay Largest Contentful Paint (LCP). That shows up in Core Web Vitals and therefore in Google Search ranking. The Spårlös script is under 1.5 KB.

3. Legal uncertainty

If Schrems III rejects the DPF in 2 years you will then have to migrate away from GA4 under time pressure, with data loss. Switching proactively is cheaper.

4. Procurement friction

If you sell to the Swedish public sector, healthcare, schools or larger companies, vendor questionnaires will ask whether you use Google Analytics. Answering "yes, but via the DPF" is not a winning answer.

When you really should switch

You should move away from GA4 now if any of the following applies:

• You are a public body (municipality, region, agency, school, healthcare).
• You sell to a public body and get the question in vendor forms.
• You handle special categories of personal data.
• You believe a cookie banner is actively hurting your conversion (most SaaS companies fall into this category).
• You want a clear and defensible GDPR status even if the DPF falls in 2 years.

What a migration looks like

In practice it is easier than you think. The modern generation of web analytics services (Plausible, Fathom, Spårlös) are cookie-free and installed with a one-line snippet:

<script defer data-site="YOUR_SITE_ID" src="https://sparlos.se/script.js"></script>

The migration typically takes 1-2 hours:

• 30 minutes: create an account, add your website, paste the snippet.
• 30 minutes: run Spårlös alongside GA4 for 48 hours to compare.
• 30 minutes: remove the GA4 code and the cookie banner. Update the privacy policy.

Spårlös is built from the ground up for the Swedish market. We provide a Swedish DPA at sign-up, invoice in SEK with F-tax, and our support answers in Swedish.

Sources and further reading

• The Swedish data protection authority (IMY) – official guidance.
• NOYB – the organization driving the Schrems cases.
• Our side-by-side comparison of Spårlös and GA4.
• Spårlös security overview with certifications and data flow.