BL - 24-154313ASD-BORG/02

Summary

Norway's Borgarting Court of Appeal upheld a NOK 65 million (€5 million) fine against the dating app Grindr, confirming it lacked valid consent to share users' personal data with advertising partners. The court ruled that app usage data indirectly revealed users' sexual orientation—classified as sensitive personal data under GDPR Article 9(1)—and that Grindr's consent mechanism failed to meet GDPR requirements for freely given, specific, and informed consent. The decision rejected Grindr's appeals across multiple court levels, finding the fine proportionate and the privacy policy misleading.

Full text

Help BL - 24-154313ASD-BORG/02: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 10:47, 7 November 2025 view sourceLde (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators181 editsm ← Older edit Latest revision as of 11:17, 21 April 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators427 editsm Line 5: Line 5: |Courtlogo=Courts_logo1.png|Courtlogo=Courts_logo1.png |Court_Abbrevation=BL|Court_Abbrevation=BL |Court_Original_Name=BORGARTING LAGMANNSRETT|Court_Original_Name=Borgarting lagmannsrett |Court_English_Name=Borgarting Court of Appeal|Court_English_Name=Borgarting Court of Appeal |Court_With_Country=BORGARTING LAGMANNSRETT|Court_With_Country=Borgarting lagmannsrett (Norway) |Case_Number_Name=24-154313ASD-BORG/02|Case_Number_Name=24-154313ASD-BORG/02 Latest revision as of 11:17, 21 April 2026 BL - 24-154313ASD-BORG/02 Court: Borgarting lagmannsrett (Norway) Jurisdiction: Norway Relevant Law: Article 4(7) GDPR Article 4(11) GDPR Article 6(1)(a) GDPR Article 7 GDPR Article 9(1) GDPR Article 9(2) GDPR Decided: 21.10.2025 Published: 21.10.2025 Parties: Grindr National Case Number/Name: 24-154313ASD-BORG/02 European Case Law Identifier: Appeal from: Oslo tingrett (Norway)23-160384TVI-TOSL/04 Appeal to: Unknown Original Language(s): Norwegian Original Source: Datatilsynet (in Norwegian) Initial Contributor: XZ A court confirmed a NOK 65 million (€5 million) fine against the dating app Grindr and found that it did not obtain valid consent to disclose its users’ personal data to advertising partners. Further, the court confirmed the qualification of data about the usage of the app as sensitive information under Article 9(1) GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts Grindr is a location-based dating app aimed at gay and bisexual men, transgender people and queer people. In 2020, the Norwegian Consumer Council filed a complaint against Grindr with the Norwegian Data Protection Authority. The reason for this was that Grindr disclosed personal data to several third parties for marketing purposes. The Norwegian Data Protection Authority concluded that Grindr disclosed personal data about its users to third parties for behavioural marketing without valid consent, and that the information about the use of the Grindr app constituted information about the users' sexual orientation or sexual relationships. In December 2021, the Data Protection Authority imposed a fine of NOK 65 million (€5 million). Grindr appealed the decision, and in 2022 the case was referred to the Privacy Appeals Board for review. In September 2023, the Board upheld the Data Protection Authority's conclusions and the decision to impose a fine. Grindr appealed against the Privacy Appeals Board’s decision, and in 2024, the Oslo District Court upheld the administrative fine. The Oslo District Court ruled that the consents were not valid and that Grindr transferred sensitive personal data to advertising partners. Grindr appealed the judgment from Oslo District Court to Borgarting Court of Appeal on 12 August 2025. Holding The Court of Appeal dismissed Grindr’s appeal and upheld the Data Protection Authority’s decision and fine. It held that the information Grindr disclosed to its advertising partners, including users’ App IDs, constituted special categories of personal data under Article 9(1) GDPR, as this data indirectly revealed users’ sexual orientation and sexual relationships. Referring to CJEU case law, the court found that information which can indirectly reveal such sensitive details falls within the scope of Article 9(1) GDPR. Grindr’s argument that the data did not “reveal” sexuality and that its purpose was purely commercial was rejected because the app’s design, marketing, and predominant use by LGBTQ+ individuals made it clear that merely being identified as a Grindr user strongly indicated a non-heterosexual orientation. Also, the court held that Grindr’s consent mechanism did not meet the GDPR’s requirements that consent be freely given, specific, and informed under Articles 4(11) and 4(7) GDPR , interpreted in light of Recitals 42 and 43 and the CJEU case law. Consent was not voluntary because users could not access the app without agreeing to data sharing, which was not necessary for the providing of the services, and the paid versions did not remedy this since personal data were shared before payment was possible. The option to change device settings to limit behavioral advertising also did not constitute valid consent, as the GDPR requires an active and unambiguous act, not inaction or reliance on default settings. Moreover, Grindr’s privacy policy was unclear and misleading, failing to explain in plain terms which data were shared, with whom, and for what purpose. Consequently, the court found that Grindr’s users had not provided valid consent, and the company therefore lacked a lawful basis under Article 6(1)(a) and Article 9(2) GDPR for sharing personal data with advertisers. The fine of NOK 65 million (€5 million) was confirmed as valid and proportionate. The court found no reason to reduce the fine, rejecting Grindr’s argument that it was excessive or inconsistent with other EU cases. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details. The Court of Appeal upholds the fine against Grindr Borgarting Court of Appeal has handed down a verdict in the Grindr case on Tuesday 21 October, and Grindr’s appeal over the District Court's verdict did not succeed. The fine of NOK 65 million was maintained. The Court of Appeal ruled that Grindr did not have valid consents to disclose personal data to advertising partners, and that data about the use of the app is special category personal data. "This is a fundamental and important decision for the right to data protection. We are pleased that our assessments have been upheld through three rounds of appeals," says Line Coll, Director General of the Norwegian Data Protection Authority. Background Grindr is a location-based dating app aimed towards gay and bisexual men, transgender people and queer people. In 2020, the Norwegian Consumer Council Grindr lodged a complaint against the app with the Norwegian Data Protection Authority. The context for the complaint was that Grindr disclosed personal data to several third parties for marketing purposes. (Read more on forbrukerradet.no) The Data Protection Authority concluded that Grindr disclosed personal data about users to third parties for behavioural advertising without a valid consent. Moreover, the fact that someone is a Grindr user was found to constitute data about their sexual orientation or sex life. In December 2021, the Data Protection Authority issued an administrative fine of NOK 65 million. Grindr appealed the decision, and in 2022 the case was sent to the Privacy Appeals Board for processing. In September 2023, the Privacy Appeals Board upheld the conclusions of the Data Protection Authority as well as the administrative fine. Grindr then took the Privacy Appeals Board’s decision to the courts, and in 2024, the Oslo District Court upheld the fine. Oslo District Court considered that Grindr’s consents were not valid, and that Grindr transferred special category personal data to advertising partners. Judgment from Borgarting Court of Appeal Grindr appealed the judgment from Oslo District Court, and the case was heard in Borgarting Court of Appeal on 12-14 August 2025. Borgarting Court of Appeal today rejected Grindr's appeal, meaning that the state won. Like the District Court, the Court of Appeal upholds our

Entities