Grindr faces fine of nearly $12 million in Norway for alleged privacy violations

The California-based app Grindr is accused of sharing user data without explicit consent.

Norway’s data protection agency is proposing a fine of $11.7 million against Grindr for the alleged improper sharing of users’ data to third-party companies for marketing purposes.

The Norwegian Data Protection Authority (DPA) said Tuesday that Grindr, which bills itself as “the world’s leading LGBTQ+ social application,” had shared, without full consent, users’ GPS locations, profile data and other information with other companies. Grindr has until Feb. 15 to argue against the decision.

The case, which applies to the free version of the app, originated with a 2020 complaint from the Norwegian Consumer Council, and it falls under Europe’s General Data Protection Regulation (GDPR). The DPA said the fine of 100 million Norwegian kroner would represent its largest ever, reflecting that “our findings suggest grave violations of the GDPR.”

“Users were not able to exercise real and effective control over the sharing of their data,” the Norwegian authority says. The regulators noted that the data-sharing also included, by default, “the fact that the user in question is on Grindr.”

“We believe that the fact that someone is a Grindr user speaks to their sexual orientation, and therefore this constitutes special category data that merit particular protection,” the authority said.

The DPA said it notified Grindr of the potential problems in February 2020, and the company replied with an unsatisfactory response in May 2020.

In a blog post dated Jan. 25, a day after the Norwegian authority had notified Grindr about the proposed penalty, Chief Privacy Officer Shane Wiley defended the West Hollywood, California, company’s practices, saying it does not share precise location data or information about a user’s age and gender.

“We share only the most basic information — which users largely control — and nothing about a user’s Grindr account details,” Wiley wrote. “This last point is worth repeating: there is nothing from within a user’s Grindr account details that is shared with an ad partner. Full stop.” The blog post did not directly address the Norwegian case.

The Grindr case is the latest example of European regulators’ willingness to penalize a big U.S. brand. In December, Ireland’s data protection agency fined Twitter about $550,000 for a now-fixed bug that accidentally exposed people’s private tweets.

The DPA said five companies that received the third-party data from Grindr are also the subject of complaints from the Norwegian Consumer Council: MoPub, which is owned by Twitter; Xandr, formerly known as AppNexus; OpenX Software; AdColony; and Smaato.

Those cases are ongoing, the DPA said.

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure