Sweden’s IMY Maps the GDPR and ePrivacy Rules for Location-Based Messages to Phones Without an App

Walk into a store, an airport or a hospital, and your phone gets a message about a gate change, a walking route to the right ward or an offer at the till. There’s no app to download and no Wi-Fi to join. Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY), has just worked out how EU privacy law applies to that kind of service. Its final sandbox report, published on November 10, 2026 and developed with the Swedish startup FastrMobi, covers which rulebook governs each step, who is responsible for what, and why replacing phone numbers with random tokens helps. The report is guidance, not a new rule or a permit. Still, it’s one of the clearest regulator walkthroughs yet of how the GDPR and the ePrivacy Directive fit together when location data comes from the mobile network.

What the service actually does

The report is built on one concrete case: a retail store. In FastrMobi’s design, the store has a small local base station. A shopper whose mobile subscription includes the messaging add-on, and who has agreed to be positioned for the service, connects to that base station the same way a phone connects to any cell. The mobile operator tells FastrMobi that a contract-verified number (the MSISDN) has connected inside the store. FastrMobi swaps the number for a random visit token tied to that store, and from then on the parties communicate using the token rather than the number.

Messages go out over RCS (Rich Communication Services), the interactive successor to SMS. On each visit the shopper chooses whether to be linked to a registered customer profile. FastrMobi tells the store which choice was made, the store sends offers or other information, and the token linked to the phone number is deleted in every system once the shopper leaves. IMY stresses two caveats that the short news summaries left out. First, the service is not yet in operation. Second, the whole analysis depends on the operator being able to restrict detection to subscribers who signed up. If that technical separation can’t be built, the legal assessment has to start over.

IMY also looked at a second scenario it added itself: the location comes from a GNSS receiver, such as GPS or Galileo, in the user’s phone, usually through an app. The contrast matters because the same business idea lands under different provisions depending on how the location is collected.

Which rulebook applies, step by step

IMY’s main point is that this isn’t a choice between the GDPR and the ePrivacy Directive. Both apply in parallel. Where the directive has a specific rule for a processing step, that rule takes priority under Article 95 GDPR, and the GDPR covers everything the directive doesn’t address, such as controller duties and data subject rights. The report leans on the CJEU’s Inteligo Media judgment of November 13, 2025 (C-654/23), which held that the ePrivacy rule on direct marketing to existing customers by electronic mail exhaustively sets the conditions for that processing, so no parallel Article 6(1) GDPR legal basis test is needed.

• Positioning through the mobile network. The operator’s handling of location for a value-added service falls under Article 6(3) of the directive if the data are traffic data (for example, which cell the phone is using) or Article 9 if they are other location data. In Sweden these provisions sit in chapter 9 of the Electronic Communications Act (LEK). Either way, the operator needs consent, and it can’t fall back on legitimate interests or any other GDPR basis.
• Positioning from the handset. If an app reads location stored on the phone, Article 5(3) applies, the same terminal-equipment rule behind cookie consent. It covers anyone who accesses the device, not just telecom providers, and it applies whether or not the information counts as personal data. Later processing of that location then needs its own GDPR legal basis.
• The messages themselves. Sending marketing by electronic mail, including SMS-type messages, falls under Article 13 of the directive (section 19 of Sweden’s Marketing Practices Act). Consent is the default, the existing-customer exception is narrow, and every message must include a valid address for opting out. IMY adds that a personalised message sent over RCS isn’t automatically marketing. A gate change is service information, while a discount is marketing.
• Consent quality. Even when the directive decides that consent is needed, the GDPR decides what valid consent means: freely given, specific, informed, unambiguous and as easy to withdraw as to give. One consent flow can cover several steps that serve the same purpose. But IMY is explicit that consent to positioning doesn’t automatically cover advertising, and users must be able to accept or refuse separate purposes separately.

Location data also carries extra risk. IMY notes that a single location point or a movement pattern can reveal health, religion or political views, for example a visit to a hospital, a place of worship or a political meeting. Those are Article 9 special categories, with stricter conditions wherever the GDPR applies. Our earlier look at commercial location data being sold on EU officials shows how quickly “just location” becomes something far more revealing.

Who is responsible for what

The role analysis follows the standard test: whoever decides the purposes and the essential means of a processing step is the controller for that step. Running the infrastructure doesn’t settle the question. If you need a refresher on the basics, our guide to data controllers versus processors covers the definitions IMY applies here.

• FastrMobi creates the tokens, can link an identified customer to a token and decides how long that link is kept. IMY says this “speaks strongly” for FastrMobi being the controller for those steps, in both the network and the GNSS scenarios.
• The store chose to message visitors, picked FastrMobi to do it, decides the content and decides which customer data are used for personalisation. That points strongly to the store being the controller for selecting and sending tailored messages.
• FastrMobi’s other roles depend on the facts. It is a processor if it only follows the store’s instructions, a possible joint controller if it helps decide what data are used, shared or stored, and an independent controller for any reuse for its own purposes, such as product development or statistics.
• The operator has duties under the telecom rules, and its GDPR role for any later steps has to be assessed separately. IMY says that doing the positioning doesn’t automatically make the operator a processor for the whole service.

IMY’s broader lesson is that one company can hold different roles under different laws and at different steps. Roles under LEK or marketing law don’t carry over to the GDPR automatically. The contracts and privacy notices need to reflect the actual step-by-step map.

Tokenisation helps, but it doesn’t anonymise

IMY recommends tokenisation as a privacy-enhancing technique and is careful about its limits. A token is a form of pseudonymisation, and pseudonymised data are still personal data. The store may never see the phone number, but that alone doesn’t make the store’s data anonymous, because other data the store holds could still identify the shopper. That is the same identifiability question explored in our piece on why true anonymization is so hard to achieve. IMY points to EDPB Guidelines 01/2025 on pseudonymisation and the draft Guidelines 02/2026 on anonymisation, and notes that neither had been finally adopted when the report came out.

For the token to protect people in practice, IMY says it has to be combined with other controls. Its recommendations work as a design checklist for any location-triggered messaging product:

1. Granular, easy withdrawal. Let users withdraw consent for one store or for the whole service, and delete or invalidate the links between number, token and profile when they do. This is where consent withdrawal design often fails.
2. A fresh choice on every visit. An earlier opt-in shouldn’t lock someone into identified mode. Each interaction should allow anonymous-token or profile-linked messaging.
3. Plain explanations over RCS. Tell users what each choice means at that moment and how to undo it.
4. Strict data-flow isolation. Keep identified and unidentified customers’ flows separate, and design APIs so the store can’t query FastrMobi’s profile data or identifiers it doesn’t need.
5. Protect what you store. Encrypt stored identifiers, and question whether phone numbers need to be kept at all.
6. Automatic deletion. Delete presence data and temporary tokens on a fixed schedule so no one can rebuild movement histories later.
7. Protected logs and consent checks. Log every call to the matching function for independent review, and automatically confirm a current, valid basis and the user’s current choice before any identifying data reach the store.

What this means outside Sweden

The legal analysis rests on EU instruments, so it is useful well beyond the Swedish retail case. Anyone building proximity marketing, venue wayfinding, stadium or airport messaging, or carrier-based location features can reuse its method. Map the positioning technique first, because that decides which ePrivacy provision applies. Then assign GDPR roles one step at a time, and treat the marketing message as a separate step with its own rules. Swedish specifics, such as LEK and the Marketing Practices Act, are enforced by other agencies (PTS and the Consumer Agency, Konsumentverket), which IMY consulted. IMY also left out third-country transfers, because the processing stays inside the EU.

Frequently asked questions

Does this mean a business can message anyone who walks in?

No. The service relies on users signing up through their operator and consenting to positioning, and the operator has to be able to limit detection to those subscribers. Being physically inside a store isn’t consent.

If we use GPS through our app instead of the network, are the rules lighter?

They’re different, not lighter. Reading location from the device triggers Article 5(3), which generally needs consent unless the access is strictly necessary for a service the user explicitly asked for. Later use still needs a GDPR basis.

Is a gate-change notice “direct marketing”?

Probably not, according to IMY’s reasoning. Direct marketing means communications with a commercial purpose sent directly to an individual. A store offer is marketing. Pure service information usually isn’t, although the content has to be judged case by case.

Can one consent screen cover everything?

One flow can cover several steps that serve the same purpose. Advertising is a separate purpose and needs its own clear choice.

The real lesson is mapping each step

Location-triggered messaging used to start with “install our app.” This design removes the app, but it doesn’t remove the legal analysis. It moves the analysis onto the network, the token vault and the consent ledger. IMY’s report is a reminder that a regulator will look at each step separately and ask who decided it, so the build plan should do the same. Read the IMY publication page and the full final sandbox report (in Swedish) before you sketch an architecture diagram.