Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Sweden is home to Mullvad, the provider we cite most often as the benchmark for independence. It also runs one of the broadest interception programmes in Europe.
Both are true, and they do not cancel out. The reason is that Swedish surveillance mostly does not go through the tunnel. It goes around it.
Three Things the State Can Do
None of them involves breaking encryption, which is the part most guides miss.
Watch the cable at the border. The signals intelligence law of 2008 authorises interception of traffic crossing Swedish frontiers. A VPN moves where your traffic appears to originate; it does not remove it from the cables it travels through.
Reach the device before encryption. The Covert Surveillance of Data Act allows law enforcement, with a permit from a court in each case, to secretly install software or hardware on a suspect’s device — or on devices the suspect is likely to contact. Anything captured there is captured before any VPN touches it.
Compel a communications operator. This is the duty a VPN provider would fall under if it were classified as one, which is the question the next section turns on.
⚠️ Notice what is absent. No proposal to break the encryption itself, because there is no need to. The tunnel was never the weak point — the endpoints are.
What Mullvad’s Own Lawyers Say
Unusually, we can quote the provider’s published legal position rather than a reviewer’s summary.
Mullvad states it is not an electronic communications service with a reporting obligation under the relevant chapter of the Swedish Electronic Communications Act, and that it therefore cannot be compelled to cooperate in enforcing a covert surveillance order.
It says so on its own site, alongside a standing analysis of Swedish legislation and a note that it retains lawyers to monitor changes.
⚠️ That is a company’s reading of a statute, not a court’s. It is a well-argued and publicly checkable reading, which is more than most providers offer, but it has not been tested in the way a ruling would test it.
The 2023 raid is the closest thing to a test. On 18 April 2023 police arrived at the Gothenburg office with a search warrant and left with nothing, because there was nothing to take — the case we treat as the strongest evidence any provider has.
The Switzerland Parallel
Two privacy havens, two flagship companies, the same year.
Switzerland’s draft ordinance would put VPN providers under identification and retention duties, and Proton has said it would leave — which we covered in full.
Sweden’s pressure fell on messaging rather than VPNs. A 2023 government inquiry recommended that encrypted messaging services retain chat data and make it available on request, and Signal’s president said publicly that the company would leave Sweden rather than comply.
⚠️ We could not establish the current status of that proposal. Reporting from early 2025 described legislation as possible from March 2026; we found nothing confirming what was ultimately adopted, so we are not stating an outcome.
The pattern is worth naming even so. Two countries that market themselves on privacy, two of the best-known privacy companies in Europe, and both threatening relocation within a year of each other.
What This Means for Your Choice
A Swedish provider is not compromised by any of this. No retention obligation reaches Mullvad today, and its published analysis explains why.
But jurisdiction is doing less work than the marketing suggests, in Sweden as in Switzerland. What protects you is the absence of data to hand over, which is a design decision rather than a postcode.
Which is why we weight audits and real tests above flags. A decade of published reports and a police warrant that found nothing is a stronger argument than any country name.
⚠️ And if the device is compromised, none of it matters. The Covert Surveillance of Data Act exists precisely because endpoint access defeats encryption entirely — what a VPN protects, and what it does not.
Living In or Visiting Sweden
The ordinary half, and it is genuinely ordinary.
Using a VPN is lawful, and nothing in Swedish law restricts it — as almost everywhere.
Public networks are the usual reason, in Stockholm as in anywhere else.
SVT Play and the other national broadcasters restrict by territory, so a Swedish address is what they want, and detection there is no harder than the European norm.
Which Providers Make Sense Here
Mullvad is the obvious answer and not automatically the right one. Flat pricing, no email at signup, audits every year, and the raid on its record. Five devices, no streaming to speak of.
Proton VPN if you want the same values with better apps, accepting that its own jurisdiction is currently under revision.
IVPN if annual auditing is the deciding factor, though at two devices on the entry plan it is the most restrictive of the three.
NordVPN if you want Swedish servers rather than a Swedish company, which is a different requirement and the more common one.
How We Research
This guide draws on Mullvad’s own published analysis of Swedish legislation, including its position on the Electronic Communications Act and the Covert Surveillance of Data Act, on a fact-checking summary of Swedish data retention developments for the 18 April 2023 search warrant and the 2025 conversion of the covert surveillance legislation into a lasting tool, on The Register for the 2023 government inquiry into encrypted messaging and Signal’s response, and on European Digital Rights for the description of the signals intelligence law and the proposed widening of bulk collection. Where a provider is describing the law that governs it, we have said so rather than presenting it as neutral analysis. We could not establish the outcome of the encryption proposal and have not implied one. We do not run our own tests. Our method lives on the About Us page.
Sweden VPN FAQ
Yes. No Swedish law restricts using, buying or installing one. The surveillance framework there concerns what the state may intercept and what operators must provide, not what individuals may run on their own devices.
Mullvad’s published legal analysis says no, on the basis that it is not an electronic communications service carrying a reporting obligation, and therefore cannot be compelled to cooperate with a covert surveillance order. That is the company’s reading of the statute rather than a court’s ruling.
On 18 April 2023 officers arrived at the Gothenburg office with a search warrant. They left with nothing, because the company held no customer data to seize. It remains the clearest real-world test of a no-logs claim among the providers we review.
Only partly, and not in the way people assume. The law authorises interception of traffic crossing Swedish borders. A VPN changes where your traffic appears to come from and encrypts its contents, but it does not remove that traffic from the cables it travels along.
Swedish legislation allowing law enforcement, with a court permit in each case, to secretly install software or hardware on a suspect’s device. It captures information before encryption is applied, which is why no VPN can defend against it.
The Verdict
Sweden does not attack the tunnel, and that is the point. It watches traffic crossing its borders and can reach a device before encryption happens, neither of which a VPN was built to prevent.
Swedish VPN providers appear to sit outside the operator duties — on their own lawyers’ published reading, which is checkable and untested.
So buy the design rather than the flag. A provider holding nothing is protected in any jurisdiction; a provider holding something is exposed in all of them.