Grindr €6.5M fined for not collecting users’ valid consent for sharing data

https://gdprhub.eu/index.php?title=Datatilsynet_(Norway)_-_20/02136-18

by j_san • 5 years ago

224 240 5 years ago

j_san• 5 years ago

The Norwegian Data Protection Authority imposed a fine of €6,500,000 on Grindr for not collecting users' valid consent for sharing data with third parties for profiling and advertising purposes from the Grindr App.

Particularly interesting is that it is not allowed under GDPR to have a free version of an app with the condition that it shares personal data (in this case for targeting and profiling for ads) as the consent of the user is not freely given in this case - in a "Take it or leave it" situation, consent cannot be seen as freely given.

Link to the section "Consent as a condition to access the service ": https://gdprhub.eu/index.php?title=Datatilsynet_(Norway)_-_2...

KarlKemp• 5 years ago

I was about to mention how well-written Norwegian legal texts are until I noticed the “edit” links. So, instead, I’ll say this is a well-written wiki article.

oytis• 5 years ago

Interesting indeed, it is what several German online newspapers do - they let you choose between a free version with tracking and a paid one without one. I find this argument a bit weird though:

Sharing Grindr's users personal data with advertising partners for online behavioural advertising purposes was not necessary for the performance of the Grindr's services.

Charging money for your services is also not necessary for the performance of the said services. Still businesses are luckily still allowed to charge money. Why can't data be considered as a means of payment in this case?

Vespasian4• 5 years ago

Because society decided that it shouldn't be.

It's a political decision that charging money (or displaying not personalized ads) is preferably.

sdoering• 5 years ago

Interesting, because said practice from German news sites seems to have the blessing of the data privacy authorities. Sadly I can't find the source. It must have been one of the data privacy newsletters I receive.

So the Norge argument here would go further and I would like to see this challenged to the European Court as this would provide a final verdict.

Currently I feel that different countries see these things quite a bit different.

On the other hand it would only mean that you can't have a free version refinanced through advertising, but would need to find other ways of converting users into paying customers while still providing a striped down free app for generating reach.

tgsovlerkhgsel4• 5 years ago

Why can't organs be considered as a means of payment?

Not sarcasm - I think that while it's obviously a different scale, the reasons are similar and boil down to "we don't want that as a society" and "the environment this creates is not conductive to a free and informed rational decision". Many people don't understand the value of their data and the risk it poses, there is an information imbalance, there is a power imbalance (the company sets the terms, and you only get to take it or leave it).

The pre-GDPR situation also showed that the market doesn't really work, because everyone was collecting your data, people have limited energy and incentive to care because it doesn't cause immediately visible pain. It's similar to workplace safety - we don't allow employers to create easily avoidable dangerous situation in exchange for extra pay either, for similar reasons.

Most importantly, data grabbing is not necessary for advertising, it's just slightly more profitable and thus everyone does it, eventually pushing the "good" (privacy-friendly) players out of the market. If we want to change that, we need a de-facto ban (which a properly implemented GDPR would be, because so many people will click "No" if given a truly free choice that showing the popup won't be worth it).

belorn• 5 years ago

Why can't data be considered as a means of payment in this case?

One of the biggest reason would be that using data as payment has demonstrated to push out companies that don't want to collect data. Data as a mean of payment is less clear to the consumer about the costs, and there is no real good way to inform the public outside of an massive investment into the general education that focus on privacy, data laws, how data is gathered, why it is gathered, how it get traded and used, and what the outcomes are. The value added through data is also not taxed which creates an unfair advantage compared to other payment methods.

cjfd• 5 years ago

The 'data is payment' thing sounds terrible. What if it really goes south and this data is involved in some identity theft? Then the criminal justice system needs to get involved at enormous cost to tax payers. Therefore, there actually is an interest of the state that all this data should not be roaming around freely.

Vespasian4• 5 years ago

It communicates that European societies (through their elected representatives) disapprove of the "paid for with your data" business model.

Yes this is limiting the free market but it's a conscious decision.

It's still allowed to process data for your own analytics (e.g. to improve your offer) and make use of third party services. What the GDPR aims to prevent is your data being shared with the whole world way beyond the entity with which you originally interacted.

If that means services cannot finance themselves through advertising anymore then so be it.

mabedan• 5 years ago

I wasn't aware of the rule against "Take it or leave it". Just yesterday I encountered a similar situation, visiting a popular German website (Heise online).

Screenshot of the "consent as a condition to access the service" https://imgur.com/a/neJya1e

vorticalbox• 5 years ago

6,500,000 NOK is $734,246 or £546,715

Edit: top of the article had an incorrect amount.

dustymcp• 5 years ago

It was euro ?

pluies• 5 years ago

At the time of writing, TFA mentioned a fine of 6,500,000NOK in the first paragraph rather than 65,000,000NOK - probably where the confusion comes from.

The HN headline is also "wrong" (or at least imprecise) - the fine amount is in NOK, so the euro figure is ~6.418 million depending on exchange rates.

detaro• 5 years ago

you missed a zero.

bonyt2• 5 years ago

65,000,000 NOK is 6,492,207 EUR

Izmaki• 5 years ago

The article brief had a 0 too few at first, but it has since been corrected.

arendtio• 5 years ago

Last sentence under 1.2.4.3

As such, it considered that a fine of €6,500,000 (NOK 65,000,000) was appropriate and dissuasive.

Hamuko2• 5 years ago

The most surprising thing about this to me is that Norway, which is not in the European Union, is also enforcing GDPR.

polote• 5 years ago

"Although not a member of the EU, Norway is a member of the European Economic Area (EEA). The GDPR was incorporated into the EEA agreement and became applicable in Norway on 20 July 2018. Norway is thus bound by the GDPR in the same manner as EU Member States."

https://www.lexology.com/library/detail.aspx?g=34dfb199-c9ab...

Vespasian4• 5 years ago

Norway is a member of the EEA and often closely aligned with EU policies

breakfastduck9• 5 years ago

I'd say GDPR is generally one of the best things to come out of the EU. I would love to see more countries at least align with it.

lutoma• 5 years ago

As far as the average person is concerned, EEA members like Norway are practically in the EU. You've got free movement, open borders due to the Schengen area, and so on. Meanwhile all the exemptions from EU law mostly concern comparatively niche areas like fishing.

dade_3• 5 years ago

Good. Grindr is probably the best example of extremely high brand & network value vs shockingly poor security & application quality. The company demonstrates zero integrity and needs to be shut down or fined to death. It would send a proper warning to the industry, though long overdue.

deepstack• 5 years ago

Why people use apps website for personal stuff like that is beyond me. Just because some hip looking company is making an app/website doesn't mean it is secure or good data custodian.

scrollaway2• 5 years ago

What’s your alternative?

Clearly people use the app because the app answers a user need. So what’s your answer to the user need?

9999000009992• 5 years ago

I think what's particularly scary about Grindr is just how much trouble even being on an app like that can get someone in. For example, a colleague of mine is from a country where being LGBT is not really tolerated, in the United States he uses Grindr.

I can imagine an oppressive government buying dating app data to blackmail their users. I noticed in the Tinder TOS thread people complaining about how impossible it is to meet folks in real life.

You can still have friends, friends have friends you can go out with. I'd say from a mental health POV you should be doing social things anyway.

dade_3• 5 years ago

To get laid, now. It’s impressive in that regard.

hungryforcodes3• 5 years ago

How else are you supposed to get laid? I don't get this comment.

secondcoming2• 5 years ago

Grindr is/was considered a poor quality brand from an advertising perspective. Nobody wants their ads to appear next to graphic images

hn_throwaway_992• 5 years ago

Not true, depending on the product. I'm sure the PreP ads I see on Grindr have no problem advertising on a gay hookup app.

But more to the point, Grindr got in trouble specifically for selling data to advertising networks presumably so they could also be targeted outside Grindr. Knowing someone's sex, sexual orientation, location, age and hobbies is great targeting data.

bonyt2• 5 years ago

For those confused about the fine amount, here is the quote from the original source:

In light of all the relevant criteria of Article 83 described above in sections 6.3-6.4, we consider that the imposition of a fine of NOK 65 000 000 is effective, proportionate and dissuasive in the present case.

https://www.datatilsynet.no/contentassets/8ad827efefcb489ab1...

This is approximately 6.49M EUR.

Hamuko2• 5 years ago

Originally they were going for a 100,000,000 NOK fine, but lowered it down to 65,000,000.

The NO DPA reviewed the fine announced in its draft decision (10,000,000 €) on the basis that the revenue of Grindr (seems to-this part is redacted) seems different and that Grindr has made with the aim to remedy the deficiencies in their previous CMP.

Draft decision: https://gdprhub.eu/index.php?title=Datatilsynet_-_DT-20/0213...

jacquesm34• 5 years ago

The sooner companies start to realize that personal data is a liability rather than an asset the better. Happy to see this fine, but as far as I'm concerned given the kind of data we're talking about here it should have been higher.

ryandrake• 5 years ago

I remember someone here putting it this way: treat user data like uranium, not oil. Both are valuable, but you don’t want to just collect and store an unlimited amount of uranium. Collect the bare minimum user data you need to operate your business and then dispose of it when it’s no longer needed.

jacquesm34• 5 years ago

That's a very good analogy, I like it.

cik2e2• 5 years ago

But, to use your analogy, why would companies treat user data like uranium when risk/reward is like that of oil?

Grinder surely made much more from data sales than the 6.something million Erous it was find. The paltry fines under GDPR do nothing to dissuade this behavio. That's been a recurring theme in previous HN discussions on this topic.

Right now, I would posit that these low penalties are for show. Governments don't want to lose the economic benefit of having these companies operate in the EU and the general public can be satisfied that their governments are on top of the issue.

dfxm12• 5 years ago

What does it mean for data to be no longer needed when one of your income streams is to sell user data?

kryogen1c3• 5 years ago

neat, this analogy travels pretty far - user data is radioactive.

theres a background amount of radiation. its everywhere, even in higher amounts than youd expect like bananas and airplanes. no amount is safe, but the risks are neglibly small when exposure is minimized. concentrated amounts can be safe when exposure is controlled and managed with oversight programs in place. disasters can be managed with disaster programs, but its still possible that unforseen problems can cause big issues. unregulated handling can poison local populations. corporate influence on government can be a problrm.

what a comparison! there should be an award for this.

Terry_Roll2• 5 years ago

You can collect as much data as you like, its what you do with it that counts.

spaetzleesser• 5 years ago

As usual this fine is not enough as deterrent.

zitterbewegung• 5 years ago

Great minds think alike .

I’ve thought of this way in a broader sense.

If you have any data from user data to internal data from various LOB it should be : Data is the new uranium.

datavirtue2• 5 years ago

The data is power and can equate to money quite easily. This means that people are not going to handle data responsibly unless forced to do so.

Most companies have zero data controls and it ends up getting passed around everywhere and saved off by employees for their own personal use.

It's like waving money in front of people when you have no way to determine if it gets stolen or by whom.

I was raised in a family bookeeping business that handled all of the vital business data for hundreds of clients. Data protection and privacy (respect for clients) were always job #1.

This came to be my philosophy for all user data in any context. A philosophy that very few people share--and the rise of the web seems to have reversed any possibility of such a philosophy taking hold as user data became a form of currency.

ftyers• 5 years ago

I read it on Idlewords: https://idlewords.com/talks/haunted_by_data.htm. Pretty much all the talks there are fantastic!

charcircuit8• 5 years ago

Or you could see it as operating in the EU is a liability. If you don't handle data in just the way they like they will come after you.

darkwater• 5 years ago

We can live without data hoarding companies, thanks.

Vespasian4• 5 years ago

Sure, like any law in any place.

EU member states and representatives decided that not having certain business models is preferably. Them leaving the single market is a welcome result.

jacquesm34• 5 years ago

The EU is merely leading the way here, you can expect all of the developed world to have similar data protection laws on the books sooner or later. And if you think that treating data in the proper way is hard then you probably shouldn't be in business at all. Operating in the EU is not a liability if you treat your users data in a respectful and responsible way. Common sense alone would answer your questions on what is and what isn't allowed in the vast majority of the cases.

That this doesn't align with the free-for-all that was the WWW for the first two and a half decades doesn't change that, morality isn't all that hard and each and every company that crosses those lines is very much aware of it. These are not accidental misinterpretations of the law by any stretch of the imagination, they are wilful abuse.

breakfastduck9• 5 years ago

What aspect of GDPR is troublesome to you?

Because 'dont abuse your ownership of personal data' is pretty much what it boils down to.

michaelbuckbee2• 5 years ago

I feel that "just the way they like" is honestly a pretty low bar to clear and in general are common sense and respectful things that you should be doing with user data in the first place.

- Tell people up front what you will do with their data

- Let them opt out

- Track what services your own service uses (Ex: your website -> google analytics)

- If people want to know what data you have about them tell them

- If people want you to delete their data (and there is no legal obligation to keep it) delete their data

- Take reasonable steps to keep user data safe

In this case Grindr was passing (per the article): advertising ID, IP address, GPS, location, gender, age, device information and app name to a bunch of Ad Services with "no control".

So beyond just "handling data" Grindr was getting paid (ads) for sharing your data to companies that could then also turn around and do whatever they wanted with that data.

denton-scratch5• 5 years ago

GDPR enforcement is pretty gentle. For the first offence you will just get a warning. Grindr's fine is a warning that you should heed such warnings.

Yes, operating in the EU is a liability; operating anywhere that has laws is a liability. And the risks of operating somewhere that doesn't have laws is an even greater liability.

michaelbuckbee2• 5 years ago

The phrase that I've found works best in communicating with non technical folks is "toxic asset".

lettergram• 5 years ago

A fine of this size indicates to me they should harvest and sell more data to increase profits. Tens of millions would still probably be worth it to Grindr.

Imagine your a government who doesn’t like homosexuals. Pay a fee - $5-$10m and you’ll get a list of users globally. Probably with travel patterns. Next time they enter the country, arrest or block visas before they enter.

Nah, this fine (which I don’t even know if they’ll pay) is the cost of doing business.

jacquesm34• 5 years ago

These fines tend to go up with repeat performances. Sooner or later some company will be fined right out of business and then we'll see whether the remainder will catch on that playing games with regulators is a losing one.

rvnx2• 5 years ago

Wait a second, it's not Grindr gathering and selling a list of homosexuals interested into sex.

It's the users themselves who actively register on Grindr to announce their services and picture on the platform.

If this activity is illegal in the country of the user, the best Grindr can do, is to prevent users from these countries from registering on the platform based on their national ID, but that's basically it.

headmelted3• 5 years ago

It's a slap on the wrist.

100x this fine would have been appropriate. Anything less just encourages other companies to treat privacy and data security as a joke.

jacquesm34• 5 years ago

Look at repeat offenses and how fast they go up. Level 1: don't do this, or we'll fine you. Level 2: here is your first fine, don't do this again or we'll fine you for real. Level 3: Ok, you clearly need something that will move the needle, here is fine you can't ignore. Level 4: you ignored it again, here is a fine that will put you out of business. So far we've only seen level 2 and one or two level 3 fines. Nobody has thought it wise to test the next levels up, it's a bit like the GPL in that respect.

bcrosby952• 5 years ago

That would be more than the full value of the company. Seems a little steep for the first fine.

stackbutterflow2• 5 years ago

What if half of the fine was given to the user(s)?

That way users would have an incentive to sue companies (i.e get rich quick). That way personal data would really have to be considered a liability if companies don't want to start giving millions to their users left and right.

GordonS2• 5 years ago

Grindr has around 4 million daily users, and up to 30 million registered users in total. Even a fine of this size would be meaningless once divided between the users.

olalonde3• 5 years ago

I'd rather let people freely decide what they want to do with their data. But this is no longer possible in Europe unfortunately.

jacquesm34• 5 years ago

It's the opposite, actually. I have no idea how you came to this conclusion.

yoaviram• 5 years ago

There's another way to make the collection of personal information less economical, which we can all contribute to. Send GDPR and CCPA data requests. Each request incurs some small but not insignificant cost for the company to handle it. This is because the process is hard to automate. Don't spam companies just for the sake of sending requests, but do get in the habit of using them to reduce your exposure.

Disclosure: I'm one of the founders of YourDigitalRights.org, a free service that makes it easy to send these sort of requests.

jacquesm34• 5 years ago

I'm all for that but only if you suspect that a company is abusing your data. Otherwise it amounts to a DDOS attack and that should be reserved for those that deserve it, not to place a burden on otherwise compliant companies.

But if you suspect that a company is abusing your data, selling it, enriching it with data that they shouldn't have: fire away.

Toby1VC• 5 years ago

I've been of the thinking that there's no smart need to be a try-hard regarding hoarding private information, or mostly in general really but that can be debated. When you reform your endevour to get profit in the short term because for some reason that's what you need, it likely will be left not properly guided and it will crash or make others crash. (I prefer) [Durable] Quality over meaningless get-by's that will be irrelevant decades from now, but that maybe bought you some time so hey ok.

nlitened3• 5 years ago

I wonder if jail time for developers knowingly implementing lax systems for exchanging personal data could help?

This way most developers would refuse to write systems that could potentially get them in trouble, until their employer transparently ensures that no laws are broken. Some kind of engineering ethics.

jacquesm34• 5 years ago

Yes, but then you'd have to prove when this stuff was written because otherwise there are going to be a lot of engineers retro-actively in the field of fire.

halostatue• 5 years ago

I work with retail tech and provide both "connector" middleware and product solutions.

When we have products that we produce that are required to keep customer data, we figure out what the _minimum_ amount of data required is to deliver the value required _to the end customer_ and do our best not to expose any more data than that.

For everything else, the goal is for our systems to hold _zero_ end customer data and _minimal_ employee data. We don’t want the liability. We do a lot of security engineering around what we do, but we want to make sure that we aren’t the source of a data breach on behalf of our customers because we aren’t holding the data in the first place.

Agamus• 5 years ago

"Seeing as data is indeed a commodity, we'd like some money also."

jacquesm34• 5 years ago

That's a complete misrepresentation of the way this fine has been structured.

vmception• 5 years ago

Brings a more coherent meaning to Value Added Tax

gr4yb34rd• 5 years ago

The thing that always bothered me most about Grindr is the fact they do not allow any connectivity from VPNs, even if you have an upgraded account. This doesn't seem to jive well with the need for privacy or anonymity in places where it's dangerous to be gay.

switch007• 5 years ago

Works with Mullvad (most of the time)

tgsovlerkhgsel4• 5 years ago

One thing I'm wondering with these fines is whether they are actually "dissuasive".

In particular, the revenue limit seems problematic. For a "normal" company whose profit margin is a relatively small fraction of revenue, 4% of revenue is huge. But for highly profitable large tech companies that make money primarily from ads, it may not be possible to issue a dissuasive fine if it is capped to 4% of revenue. Maybe "4% of revenue, or 200% of profit, whichever is higher" would be a better limit.

jacquesm34• 5 years ago

The first fine, usually not. But that fine indicates that regulators have reached a level of pretty serious frustration at a company not doing enough. Second fines are at the level that you'll be talking about them in the board room on how you managed to mess this up so colossally. I haven't seen any third fines yet, but I'm pretty sure we'll see one in 2022 or 2023. And likely the company that is in luck will go right out of business.

And after that I expect compliance will be a much easier subject. So far the whole roll-out has been exactly as I expected it to be.

tgsovlerkhgsel4• 5 years ago

My point though is that the maximum fines they can hand out, even for the third offense, are so low that they can't really give effective fines to some companies (unless they apply such a fine e.g. per user whose rights were violated, which doesn't seem to be what they're doing).

Grindr made a profit of $31M and a revenue of "well over $100M". The maximum fine is 20M EUR or 4% of revenue (whichever is higher). So assuming under 500M EUR in revenue, the maximum fine is lower than Grindr's 2019 profit. So if Grindr is the lucky one that serves as an example, I don't see how even the absolute worst case fine would put them out of business.

Although the max fine is probably higher than the 2019 profit from the EU, I could totally see that changing, and someone deciding that getting slapped with the maximum fine is cheaper than the loss of revenue from complying, especially if it is a business that is entirely in ads.

tmarice• 5 years ago

Grindr is incorporated in the US, I'm not sure how they plan to enforce this fine.

kristopolous• 5 years ago

IANAL but the lawyers I've worked with have said unpaid violations lead to cutting off business relations until fines are satisfied.

I'm sure it's more complicated but the general idea is economic coercion.

Now given that, the class of proximity based apps are all regional (such as dating, dog walking, delivery, etc).

I have no idea if Grindr has a market penetration in Europe to make it worthwhile. Companies have been known to completely vacate markets instead of honor fines or fees.

ryanlol• 5 years ago

As if grindr doesn’t collect any payments in Europe or have executives who enjoy their ability to travel.

leodriesch2• 5 years ago

The EU operations of Grindr have to follow European laws and will therefore have to pay the fee or leave the European market.

If they won’t leave or pay, the EU could possibly force app stores to remove the app from their region or something similar.

simion314• 5 years ago

Grindr is incorporated in the US, I'm not sure how they plan to enforce this fine.

You put the company on a black list, then banks or other companies in EU or that have business in EU can't send them money or work with them, I am assuming they offer some subscriptions and other paid features so the banks not working with them will hurt.

fulafel• 5 years ago

Maybe someone for Norway can pitch in about how this works.

Even though Norway is not a EU country, it's part of the EEA and various other treaties with the EU and hence they ended up implementing GDPR, it seems possible that they end up being having authority to enact EU/EEA wide enforcement actions.

keewee7• 5 years ago

Maybe it's time that frameworks like Django and Rails make it easier to be GDPR compliant from day 1. ASP.NET Core has APIs and templates for this:

https://docs.microsoft.com/en-us/aspnet/core/security/gdpr?v...

nlitened3• 5 years ago

Maybe it’s time companies stop hoarding and reselling users’ personal data.

These built-in templates for cookie popups are a joke, IMO.

donarb• 5 years ago

Maybe it's time that frameworks like Django and Rails make it easier to be GDPR compliant from day 1

The first step in being GDPR compliant is not installing a tracking library in your project. Web frameworks have no control over that.

lobocinza• 5 years ago

Somewhat related. Not long after creating a Tinder account using an unique mail address I received a phishing mail on that address.

denton-scratch5• 5 years ago

I received a phishing mail

I was on Tinder for about a week. I was receiving dating spam for a year - not "a phishing email". Hopefully Tinder will be the next up against the wall. They're shameless.

crazy1van• 5 years ago

Unfortunately, data collection and data sales (either of the data directly or via targeted ads) is how many modern internet companies generate revenue. It’s easy to claim that they should just charge money directly for their product but their would-be customers seem to rather pay with their data than a monthly fee.

In fact, anecdotally, it’s often the vocal critics of data-funded tech companies who post an archive.is version of every paywalled article.

xemoka• 5 years ago

Oh man, that’s such a false equivalency. Because someone thinks journalism should be done in the open, particularly when the topic of commentary, doesn’t mean they want their private information (location, sex partners, whatever) sold to the highest bidder without their informed consent.

cblconfederate5• 5 years ago

that is attacking a strawman that the comment did not make. It IS a paradox that people want information to be free but not if other people use it for advertising.

NelsonMinar• 5 years ago

Grindr is a repeat offender, globally.

In 2018 researchers found that Grindr was sharing users' HIV status and location with marketing companies: https://www.buzzfeednews.com/article/azeenghorayshi/grindr-h...

Just this year there was a scandal where an anti-gay church fired one of its officials because a homophobic publication somehow got access to his Grindr account and his location data. The details on how the data got out are not clear. https://www.vice.com/en/article/pkbxp8/grindr-location-data-...

mistrial9• 5 years ago

From a systems point of view, the "boiling over" of agitated Grindrs data is no surprise as the source of obvious data abuse, similar to the way that the data on compulsive gamblers is used and abused, I suspect. Yet this is only a tip of an iceburg.

In My Own Opoinion - this "surveillance capitalism" is a huge, stinking cancer on free society and is only getting started.. history will show this is absolutely true. "I have nothing to hide" people can get a free Grindr subscription for all I care.. this is a rotten situation.

Grindr €6.5M fined for not collecting users’ valid consent for sharing data

Related Stories