Privacy: Grindr in trouble with Norwegian authorities

According to Norwegian data protection authorities, Grindr has violated the General Data Protection Regulation (GDPR). As a result, a hefty fine in the millions has now been imposed.

Sharing sensitive data

If you take a look at why the dating app Grindr is in trouble with the Norwegian authorities, you can certainly understand why it has been fined millions. After all, the Norwegian Data Protection Authority (NO DPA) found out that the company shared users’ personal data without their consent. The operators are now to pay a total of 65 million Norwegian kroner. This is roughly equivalent to 6.5 million euros. After extensive research, data protection experts are certain that the app sold its users’ data to third-party companies in order to forward tailored advertising. However, according to the GDPR, this procedure, known as profiling, is not possible without the explicit consent of the users. Grindr, on the other hand, merely listed this procedure in its T&Cs. This is not sufficient. If you add up the duration in which Grindr has worked in this way, a period of more than two years comes about (July 2018 to April 2020).

Complaint already 2020

The Norwegian Data Protection Authority has already drawn attention to the app’s abuses in 2020. On the grounds of unauthorized use of personal data for advertising purposes, the authority therefore filed a complaint. On closer inspection, it becomes clear that this was indeed extremely sensitive data. In addition to user location data, gender and age were also passed on. The data transfer has a bitter aftertaste, especially for Grindr. Since the app is intended as a dating platform for homosexuals, queer and bisexual people, anonymity is often important to them. That’s why many users are likely to get a cold shiver down their spine when they now read that full names have been passed on in some cases. Accordingly, the Norwegians see themselves forced to impose the high penalty.

Penalty increased

If it had gone according to the original plan of the data protection authority, the penalty payment would probably have been 100 million Norwegian kroner. However, in the end, they did show some concession. This is not least due to the fact that the data protection deficiencies have since been rectified. After all, the app now explicitly asks for the consent of its users. Grindr now has three weeks to appeal the penalty. However, since the data protection violation is so obvious, this will not have much chance of success.