Grindr

What happened

Norway's Datatilsynet fined Grindr €6.3 million (reduced from initial €10M) for sharing users' personal data — including GPS location, user profile data, and the fact that they used Grindr (which reveals sexual orientation, a special category of data) — with advertising partners without valid consent. Consent was bundled into the app's terms of service, making it non-specific and not freely given.

Articles violated

Lessons learned

Apps that reveal sensitive personal data (sexual orientation, health, religion) through their nature must treat usage data as special category data under Art. 9. Consent must be specific and granular — bundling consent into terms of service is not valid. Third-party data sharing for advertising requires separate, explicit consent. The use of an app itself can constitute special category data.