6.4 million Euro fine against Grindr LLC
Insufficient information and no valid consent regarding the transmission of user data to third parties.

The company operates the location-based dating app Grindr, which targets the LGBTQ community and has a total of 13.7 million users worldwide and several thousand users in Norway.

The Norwegian Consumer Agency (Forbrukerrådet) filed a complaint with the Norwegian Data Protection Authority against the app operator because the defendant had unlawfully transferred personal data (GPS location, profile information, the fact that the data subject was using the app) to various third parties for advertising purposes. With the sexual orientation of the users, a special category of personal data was also affected by this practice.

As the authority found in its investigations, users had to accept the company's full privacy policy in order to use the app. There was no option to specifically not consent to the transfer of their data to third parties, which meant that consent was not voluntary. Similarly, users were not sufficiently and specifically informed about the details of the transfer, including information about the third parties with whom their data was shared.

The infringement is also considered serious in light of the fact that, contrary to the users' interest in keeping the sensitive content of the app as discreet as possible, their data was nevertheless shared with an unknown number of third parties in a non-transparent manner. In view of this, the present fine is the highest ever imposed by the Norwegian data protection authority.