Norway’s Data Protection Agency, Datatilsynet, issued a $7 million GDPR fine to the gay, bi, trans, and queer app Grindr for processing and sharing user data—including highly sensitive information relating to data subjects’ sexual orientation—to advertisers without consent.
The DPA found specific violations of GDPR Article 6(1) on lawful processing and 9(1) on processing of special categories of personal data. The DPA determined that “users were forced to accept the privacy policy in its entirety to use the app, and they were not asked specifically if they wanted to consent to the sharing of their data with third parties for behavioural advertisement.” The DPA also found that “the information about the sharing of personal data was not properly communicated to users [ . . . ] We consider that this was contrary to the GDPR requirements for valid consent.”
The DPA’s decision highlights increasing regulatory scrutiny of valid consent under the GDPR, particularly for processing Article 9 highly sensitive data such as sexual orientation. The decision also shows that some DPAs regard a company’s “take it or leave it” approach to consumers for app services as a potential basis for a GDPR violation, a stance that has some in the industry viewing the decision as a warning against tracking without communicated and specific consent.
Sources:
