Grindr – Court Ruling (Norway, 2025)

Grindr is a location-based dating app aimed at gay and bisexual men, transgender people and queer people. In 2020, the Norwegian Consumer Council filed a complaint against Grindr with the Norwegian Data Protection Authority. The reason for this was that Grindr disclosed personal data to several third parties for marketing purposes. The Norwegian Data Protection Authority concluded that Grindr disclosed personal data about its users to third parties for behavioural marketing without valid consent, and that the information about the use of the Grindr app constituted information about the users' sexual orientation or sexual relationships. In December 2021, the Data Protection Authority imposed a fine of NOK 65 million (€5 million). Grindr appealed the decision, and in 2022 the case was referred to the Privacy Appeals Board for review. In September 2023, the Board upheld the Data Protection Authority's conclusions and the decision to impose a fine. Grindr appealed against the Privacy Appeals Board’s decision, and in 2024, the Oslo District Court upheld the administrative fine. The Oslo District Court ruled that the consents were not valid and that Grindr transferred sensitive personal data to advertising partners. Grindr appealed the judgment from Oslo District Court to Borgarting Court of Appeal on 12 August 2025. The Court of Appeal dismissed Grindr’s appeal and upheld the Data Protection Authority’s decision and fine. It held that the information Grindr disclosed to its advertising partners, including users’ App IDs, constituted special categories of personal data under Article 9(1) GDPR, as this data indirectly revealed users’ sexual orientation and sexual relationships. Referring to CJEU case law, the court found that information which can indirectly reveal such sensitive details falls within the scope of Article 9(1) GDPR. Grindr’s argument that the data did not “reveal” sexuality and that its purpose was purely commercial was rejected because the app’s design, marketing, and predominant use by LGBTQ+ individuals made it clear that merely being identified as a Grindr user strongly indicated a non-heterosexual orientation. Also, the court held that Grindr’s consent mechanism did not meet the GDPR’s requirements that consent be freely given, specific, and informed under Articles 4(11) and 4(7) GDPR , interpreted in light of Recitals 42 and 43 and the CJEU case law. Consent was not voluntary because users could not access the app without agreeing to data sharing, which was not necessary for the providing of the services, and the paid versions did not remedy this since personal data were shared before payment was possible. The option to change device settings to limit behavioral advertising also did not constitute valid consent, as the GDPR requires an active and unambiguous act, not inaction or reliance on default settings. Moreover, Grindr’s privacy policy was unclear and misleading, failing to explain in plain terms which data were shared, with whom, and for what purpose. Consequently, the court found that Grindr’s users had not provided valid consent, and the company therefore lacked a lawful basis under Article 6(1)(a) and Article 9(2) GDPR for sharing personal data with advertisers. The fine of NOK 65 million (€5 million) was confirmed as valid and proportionate. The court found no reason to reduce the fine, rejecting Grindr’s argument that it was excessive or inconsistent with other EU cases.