Sensitive Grindr data sold illegally: Company must pay record fine
The Norwegian Data Protection Authority has fined the advertising company Xandr the equivalent of just over eight million Swiss francs. The reason for this is the unauthorized trading of user data from the gay dating app "Grindr".
The app Grindr is considered one of the largest dating apps for gay, bisexual, transgender, and queer individuals. Between July 2018 and April 2020, data from users of this app ended up in automated advertising auctions, known as real-time bidding. In these auctions, companies bid on ad slots in fractions of a second and, in return, receive information about the person viewing the ad. In the case of Grindr, this included data on sexual orientation. The General Data Protection Regulation (GDPR) classifies such data as particularly sensitive and worthy of protection. In Norway alone, this affects several thousand people.
The tech advertising company Xandr, a Microsoft subsidiary, argued that Grindr had obtained consent from its users. However, Xandr did not verify this. Consequently, the Norwegian Data Protection Authority rejected this argument and issued a fine of 92 million Norwegian kroner. This is equivalent to just under 8 million Swiss francs.
An appeal against the decision can be filed within three weeks. Since the violations occurred before Microsoft's acquisition (2022), the fine is based on the revenue of the company Xandr. Accordingly, it is relatively low.
Grindr has also had to pay
The proceedings against Xandr stem from complaints by the Norwegian Consumer Council, Forbrukerrådet. These were filed in January 2020 against Grindr and four other ad-tech companies. These, in turn, are based on the report "Out of Control," for which the council collaborated with the security company Mnemonic, tracking researcher Wolfie Christl, and the European Center for Digital Rights (noyb).
Fines have also already been issued against the Grindr app. In a case that wound its way through various levels of the Norwegian judicial system from December 2021 to October 2025, Grindr ultimately had to pay a fine of 65 million Norwegian kroner (approximately 5.6 million Swiss francs).
Far more significant than the relatively small fine is the symbolic impact of this ruling. For instance, noyb refers to this judgment as a precedent for similar cases. The Norwegian Consumer Council also views this as a signal to companies that engage in tracking and profiling.
I've been tinkering with digital networks ever since I found out how to activate both telephone channels on the ISDN card for greater bandwidth. As for the analogue variety, I've been doing that since I learned to talk. Though Winterthur is my adoptive home city, my heart still bleeds red and blue.
From the latest iPhone to the return of 80s fashion. The editorial team will help you make sense of it all.
Show all
