The law – what applies right now?
Updated 4 October 2026. A simplified explanation, not legal advice.
Why can these sites show your address?
Sites such as Ratsit, Hitta, MrKoll and Merinfo hold a publishing certificate (utgivningsbevis) from the Swedish Agency for the Media. It gives them the same constitutional protection as a newspaper. So far they have said the GDPR doesn’t apply to what they publish, and that they don’t have to erase anything.
EU Court: a certificate isn’t enough
On 9 July 2026 the Court of Justice of the EU ruled in case C-199/24, about the court-records database Lexbase. It held that a publishing certificate does not in itself exempt an activity from the GDPR. Exemptions can only cover processing for journalistic, academic, artistic or literary purposes.
The case now goes back to Attunda District Court, which will decide whether Lexbase’s activity is journalism. The ruling was about a site with criminal judgments. Whether the same applies to sites showing addresses and phone numbers has not yet been tested.
The data protection authority is reviewing four sites
The Swedish Authority for Privacy Protection (IMY) is reviewing Lexbase, Krimfup, Upplysning.se and MrKoll. Two of the reviews concern whether the sites break the GDPR by not erasing data on request. Meanwhile IMY isn’t investigating individual complaints against these sites. Decisions are expected in autumn 2026.
No constitutional change for now
A government inquiry proposed in 2024 to limit the constitutional protection for these sites from 2027. In November 2025 the government said it would not take the proposal forward for now. Instead, regulating the sites through ordinary law will be investigated. A separate inquiry into background checks is due by 11 March 2027.
What does it mean for you?
- Use the sites’ own ways of hiding you. That is usually fastest.
- You can also request erasure under the GDPR. The sites may say no, but after the EU Court’s ruling they stand on weaker ground. Keep their reply.
- They must answer within one month. An automatic reply doesn’t count.
- We’ll update this page when IMY or the courts have decided.