The gay dating app Grindr is facing a €9.6m fine in Norway, equivalent to 10 per cent of its revenues, after officials concluded it had shared user data without consent.
The decision is preliminary, but if the fine is confirmed, it will be the largest penalty considered by the Norwegian Data Protection Authority (DPA) to date.
The DPA said that Grindr’s users were forced to accept its privacy policy and that the app did not inform them that their data would be shared with third parties, or ask for their consent.
As a result, sensitive personal information was shared with advertising companies. Grindr did not immediately respond to a request for comment.
“Grindr is seen as a safe space, and many users wish to be discreet. Nonetheless, their data have been shared with an unknown number of third parties, and any information regarding this was hidden away,” said Bjorn Erik Thon, director-general of the DPA.
Grindr has come under scrutiny over its data protection practices in the past. In 2018, the Norwegian Consumer Council filed a complaint against the company after a report by Norwegian research institute Sintef said the company had shared data including HIV status with two third parties.
The company responded at the time and said it had not sold personal user information to third parties or advertisers, and that it would take steps to “discontinue sharing” HIV status, which was used to provide services such as HIV testing reminders.
“The message is simple: ‘take it or leave it’ is not consent. If you rely on unlawful ‘consent’ you are subject to a hefty fine. This does not only concern Grindr, but many websites and apps,” said Ala Krinickytė, data protection lawyer at noyb, a campaign group that filed a complaint against Grindr, together with the Norwegian Consumer Council and the European Center for Digital Rights.
Daily newsletter
#techFT brings you news, comment and analysis on the big companies, technologies and issues shaping this fastest moving of sectors from specialists based around the world. Click here to get #techFT in your inbox.
The DPA said that investigations against the five adtech companies that received data from Grindr, including Twitter-owned MoPub, were continuing.
Grindr has until February 15 to respond to the decision. The company was sold last year by Beijing Kunlun Tech, a gaming company, to San Vicente Acquisition for about $608.5m after concerns about its ownership were raised by the Committee on Foreign Investment in the United States.