Grindr Fined €6.5 million for Breaching GDPR Consent Requirements
Norway’s data privacy watchdog has issued a 6.5 million Euro fine to a location-based social networking app for gay, bisexual, trans, and queer people, Grindr, for sharing sensitive personal data without valid user consent. The Grindr privacy breach fine is the largest to date handed down by the Norwegian Data Privacy Authority (NDPA). It appears Grindr has accepted the fine, given that the three weeks the app had to appeal the decision have now lapsed.
Personal Information Shared in the Grindr Privacy Breach
The fine resulted from Grindr sharing the personal data of its users with third parties for marketing purposes, without valid consent.
The NDPA’s press release revealed that data shared without user consent included:
- GPS location data.
- IP address.
- Advertising ID.
- User profile data.
- Sensitive information about the users’ sexual orientation – by virtue of the fact that they were using an app for gay, bi, trans, and queer people.
The personal and sensitive information was shared with third parties in a manner that made it possible for users to be identified. Moreover, the data was shared in such a way that the recipients could potentially further share the users’ personal and sensitive information.
Details of Grindr’s Privacy Breach
The complaint stemmed from Grindr sharing personal data with five third parties for advertising purposes. It was alleged (and later decided) that Grindr did not obtain valid consent from its users to disclose this information to third parties.
Specifically, the complaints were threefold:
Complaint 1 describes the data sharing from the Grindr app with third parties using Twitter’s MoPub as a mediation partner. The categories of personal data being transmitted are similar, with small exceptions like AppNexus receiving the IP address and OpenX receiving keywords.
Complaint 2 describes the direct transmissions from the Grindr app to AdColony. The categories of personal data being shared are similar to the ones in Complaint 1, with addition of e.g. user’s permission settings, Grindr User ID and the indication of “explicit consent”.
Complaint 3 describes the direct transmissions from the Grindr app to Smaato. The categories of personal data being shared are similar to the ones in Complaint 1, with addition of e.g. user’s permission settings and the consent string.
Why the ‘Consents’ Obtained by Grindr Were Invalid
The NDPA analysed this consent collection mechanism in detail, finding that Grindr’s consent mechanisms fell afoul of the GDPR requirements. Here’s an overview of the detailed analysis provided in the NDPA’s decision:
GDPR Consent Requirements
Article 4(11) of the GDPR notes that valid consent is only obtained where it is freely given, specific, informed, and unambiguous.
In its analysis of whether user consent to Grindr was freely given, the NDPA considered whether not allowing for separate consents to be given to different personal data processing operations meant that users were not freely giving their consent.
The NDPA relied on Recital 43 of the GDPR and the European Data Protection Board (EDPB) Guidelines in determining that:
“…we can establish that Grindr’s previous consent mechanism did not allow for separate consents to be given to different purposes or processing operations despite it being appropriate, indicating that consent was not “freely given”.”
Recital 43 of the GDPR
Recital 43 of the GDPR states that:
“Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case…”
The EDPB Guidelines on Consent
The EDPB Guidelines on Consent note that consent is presumed not to be freely given where it is bundled up as a non-negotiable part of terms and conditions. Moreover, it also asserts that consent will not (usually) be valid where a data subject has no real choice, feels compelled to consent, or will endure negative consequences if they do not consent.
You can read the EDPB’s Guidelines on Consent here: https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
Further Reasons for the NDPA’s Decision on the Grindr Privacy Breach
The way Grindr made consent to the processing of personal data that’s not necessary for the performance of the service an absolute requirement to gain access to the app was also seen as problematic by the NDPA. Given that users needed to provide their consent for their personal and sensitive information to be disclosed to third-party advertisers to even gain access to the app, the NPDA deemed that the consents obtained were invalid on the basis that:
- Access to services in the free version of the app was made conditional on consenting to Grindr sharing personal data with advertising partners despite this not being necessary for the performance of the service; and
- Data subjects could not refuse or withdraw consent without detriment.
Moreover, it was determined that the consents provided by data subjects were not informed, specific, or unambiguous.
You can find more details about the NDPA’s analysis in the 68-page NDPA Decision (in English) here: https://www.datatilsynet.no/contentassets/8ad827efefcb489ab1c7ba129609edb5/administrative-fine—grindr-llc.pdf
What Would Valid Consent Have Looked Like for Grindr?
The NDPA noted that separate consents for the requests for sharing personal data with advertising partners would have been “appropriate and practical”. It noted the lack of granularity in the way Grindr obtained its consent as being key in its determination that consent was not freely given.
“In sum, refusing consent under Grindr’s previous CMP was dependent on the user’s patience and technological understanding, and it did not demonstrate a fair, intuitive and genuine free choice.”
The magnitude of the fine highlights the importance of obtaining valid consent. Here are some key takeaways for businesses looking to implement GDPR-compliant consent mechanisms:
- Do not make consent to disclose personal information a requirement unless it is necessary for the functionality of the app or the provision of services.
- Separate consents for different types of data processing.
- Make the consent mechanisms as granular as practicable.
- Make it clear to data subjects that their data will be shared with third parties (if that’s the case).
- Ensure clear, easy-to-understand, and jargon-free language is used when describing privacy practices.
Further Resources on Privacy Breaches
Meet Your Privacy Obligations with Privacy 108
Privacy 108’s team works with organisations throughout the Australian-Pacific to ensure compliance with global privacy requirements, including those under the GDPR, CCPA, PIPA, and Australia’s Privacy law. For assistance meeting your privacy obligations, reach out.