Grindr is a dating app for men who have sex with men. The app shared user data with advertising partners, including GPS location, device information, and the fact that the person was a Grindr user. The Norwegian Data Protection Authority found that this in itself revealed sensitive information about sexual orientation.
The consent was not valid. Users had to agree to sharing with advertising partners to use the app at all. It was not a free choice. GDPR requires consent for processing special categories personal data is explicit, specific, and freely given — not embedded in the terms of use.
The Norwegian Data Protection Authority fined Grindr 65 million kroner in 2021. The Personal Data Protection Board, district court, and now the court of appeal have all confirmed the decision. Four instances—the same conclusion.
**Practical point:**
Does your company process data that could indirectly reveal health, religion, trade union membership, or sexual orientation? If so, stricter rules apply. Consent must be specific to the purpose – not hidden in an «accept terms» field. Review your consent forms and check if they actually cover what you do.
Inspired by: The Norwegian Data Protection Authority