Grindr's ad-data sharing earned Norway's biggest privacy fine — and it stuck

On 13 December 2021, Norway's data protection authority, Datatilsynet, fined the dating app Grindr NOK 65 million — about €6.5 million — for sharing users' personal data with third parties for behavioural advertising without a valid legal basis. The fine was the largest the Norwegian regulator had ever imposed.

The investigation began after complaints from the Norwegian Consumer Council in 2020. Datatilsynet found that Grindr disclosed data including precise GPS location, IP address, mobile advertising ID, age and gender to an unknown number of advertising partners, and that the 'consent' it collected was not valid under the GDPR: users had no real choice during registration, and the sharing was buried in the privacy policy.

Compounding the problem, the fact that someone is a Grindr user was treated as revealing a non-majority sexual orientation — a special category of personal data under GDPR Article 9. The unlawful sharing ran from about May 2018 until April 2020, and the regulator treated it as intentional. The consent mechanisms were found to breach GDPR Articles 6 and 9.

Grindr appealed. The Norwegian Personal Data Appeals Board confirmed the NOK 65 million fine in September 2023, and the Oslo courts rejected Grindr's annulment actions. On 21 October 2025 the Court of Appeal again upheld the fine, this time around €5.5 million, ending the legal fight.