14 ms·
Grindr €6.5M fined for not collecting users’ valid consent for sharing data
- deleted 5y ago[deleted]
- Agamus 5y ago"Seeing as data is indeed a commodity, we'd like some money also."
- j_san 5y agoThe Norwegian Data Protection Authority imposed a fine of €6,500,000 on Grindr for not collecting users' valid consent for sharing data with third parties for profiling and advertising purposes from the Grindr App. Particularly interesting is that it is not allowed under GDPR to have a free version of an app with the condition that it shares personal data (in this case for targeting and profiling for ads) as the consent of the user is not freely given in this case - in a "Take it or leave it" situation, consent cannot be seen as freely given. Link to the section "Consent as a condition to access the service ": https://gdprhub.eu/index.php?title=Datatilsynet_(Norway)_-_20/02136-18#Consent_as_a_condition_to_access_the_service https://gdprhub.eu/index.php?title=Datatilsynet_(Norway)_-_2...
- deleted 5y ago[deleted]
- KarlKemp 5y agoI was about to mention how well-written Norwegian legal texts are until I noticed the “edit” links. So, instead, I’ll say this is a well-written wiki article.
- oytis 5y agoInteresting indeed, it is what several German online newspapers do - they let you choose between a free version with tracking and a paid one without one. I find this argument a bit weird though: > Sharing Grindr's users personal data with advertising partners for online behavioural advertising purposes was not necessary for the performance of the Grindr's services. Charging money for your services is also not necessary for the performance of the said services. Still businesses are luckily still allowed to charge money. Why can't data be considered as a means of payment in this case?
- arlcode 5y agoBecause society decided that it shouldn't be. It's a political decision that charging money (or displaying not personalized ads) is preferably.
- nickpp 5y agoThis hurts most people with less money to pay, as they can’t access the service otherwise.
- sippeangelo 5y agoIt exploits most people with less money to pay, as they're not privileged enough to access the service otherwise.
- nickpp 5y agoSo offering people with no means to pay another way to access the service (in exchange of something quite worthless to them, their "data") is now exploitation?
- akie 5y agoThe GDPR has a provision that requires that the same level of access to the service has to be provided regardless of your privacy/tracking choice.
- arlcode 5y agoIt communicates that European societies (through their elected representatives) disapprove of the "paid for with your data" business model. Yes this is limiting the free market but it's a conscious decision. It's still allowed to process data for your own analytics (e.g. to improve your offer) and make use of third party services. What the GDPR aims to prevent is your data being shared with the whole world way beyond the entity with which you originally interacted. If that means services cannot finance themselves through advertising anymore then so be it.
- mabedan 5y agoI wasn't aware of the rule against "Take it or leave it". Just yesterday I encountered a similar situation, visiting a popular German website (Heise online). Screenshot of the "consent as a condition to access the service" https://imgur.com/a/neJya1e https://imgur.com/a/neJya1e
- vorticalbox 5y ago6,500,000 NOK is $734,246 or £546,715 Edit: top of the article had an incorrect amount.
- dustymcp 5y agoIt was euro ?
- pluies 5y agoAt the time of writing, TFA mentioned a fine of 6,500,000NOK in the first paragraph rather than 65,000,000NOK - probably where the confusion comes from. The HN headline is also "wrong" (or at least imprecise) - the fine amount is in NOK, so the euro figure is ~6.418 million depending on exchange rates.
- detaro 5y agoyou missed a zero.
- arendtio 5y agoLast sentence under 1.2.4.3 > As such, it considered that a fine of €6,500,000 (NOK 65,000,000) was appropriate and dissuasive.
- Hamuko 5y agoThe most surprising thing about this to me is that Norway, which is not in the European Union, is also enforcing GDPR.
- polote 5y ago"Although not a member of the EU, Norway is a member of the European Economic Area (EEA). The GDPR was incorporated into the EEA agreement and became applicable in Norway on 20 July 2018. Norway is thus bound by the GDPR in the same manner as EU Member States." https://www.lexology.com/library/detail.aspx?g=34dfb199-c9ab-463c-8c5c-57404e1a3248 https://www.lexology.com/library/detail.aspx?g=34dfb199-c9ab...
- arlcode 5y agoNorway is a member of the EEA and often closely aligned with EU policies
- breakfastduck 5y agoI'd say GDPR is generally one of the best things to come out of the EU. I would love to see more countries at least align with it.
- lutoma 5y agoAs far as the average person is concerned, EEA members like Norway are practically in the EU. You've got free movement, open borders due to the Schengen area, and so on. Meanwhile all the exemptions from EU law mostly concern comparatively niche areas like fishing.
- dade_ 5y agoGood. Grindr is probably the best example of extremely high brand & network value vs shockingly poor security & application quality. The company demonstrates zero integrity and needs to be shut down or fined to death. It would send a proper warning to the industry, though long overdue.
- deepstack 5y agoWhy people use apps website for personal stuff like that is beyond me. Just because some hip looking company is making an app/website doesn't mean it is secure or good data custodian.
- scrollaway 5y agoWhat’s your alternative? Clearly people use the app because the app answers a user need. So what’s your answer to the user need?
- e0a74c 5y agoWe also got laid before the invention of the smartphone, you know...
- officeplant 5y agoWe're also deep in a pandemic where olden times means of socialization are pretty restricted. I'm not gonna walk into a bar in 2021 to be assaulted by smoke, sound, and covid. Just the smoke and sound has been enough to keep me out of them for over a decade now.
- e0a74c 5y agoEach to their own, I guess. I liked our dirty old ways and the fact that no Silicon Valley creep could spy on our intimate relations.
- denton-scratch 5y ago
- bonyt 5y agoFor those confused about the fine amount, here is the quote from the original source: > In light of all the relevant criteria of Article 83 described above in sections 6.3-6.4, we consider that the imposition of a fine of NOK 65 000 000 is effective, proportionate and dissuasive in the present case. https://www.datatilsynet.no/contentassets/8ad827efefcb489ab1c7ba129609edb5/administrative-fine---grindr-llc.pdf https://www.datatilsynet.no/contentassets/8ad827efefcb489ab1... This is approximately 6.49M EUR.
- Hamuko 5y agoOriginally they were going for a 100,000,000 NOK fine, but lowered it down to 65,000,000. >The NO DPA reviewed the fine announced in its draft decision (10,000,000 €) on the basis that the revenue of Grindr (seems to-this part is redacted) seems different and that Grindr has made with the aim to remedy the deficiencies in their previous CMP. Draft decision: https://gdprhub.eu/index.php?title=Datatilsynet_-_DT-20/02136 https://gdprhub.eu/index.php?title=Datatilsynet_-_DT-20/0213...
- jacquesm 5y agoThe sooner companies start to realize that personal data is a liability rather than an asset the better. Happy to see this fine, but as far as I'm concerned given the kind of data we're talking about here it should have been higher.
- ryandrake 5y agoI remember someone here putting it this way: treat user data like uranium, not oil. Both are valuable, but you don’t want to just collect and store an unlimited amount of uranium. Collect the bare minimum user data you need to operate your business and then dispose of it when it’s no longer needed.
- ftyers 5y agoI read it on Idlewords: https://idlewords.com/talks/haunted_by_data.htm https://idlewords.com/talks/haunted_by_data.htm. Pretty much all the talks there are fantastic!
- jacquesm 5y agoThat's a very good analogy, I like it.
- cik2e 5y agoBut, to use your analogy, why would companies treat user data like uranium when risk/reward is like that of oil? Grinder surely made much more from data sales than the 6.something million Erous it was find. The paltry fines under GDPR do nothing to dissuade this behavio. That's been a recurring theme in previous HN discussions on this topic. Right now, I would posit that these low penalties are for show. Governments don't want to lose the economic benefit of having these companies operate in the EU and the general public can be satisfied that their governments are on top of the issue.
- MauranKilom 5y ago> Grinder surely made much more from data sales than the 6.something million Erous it was find. ...sure, but they also had business expenses. Fining them for all the revenue would more or less instantly kill the company, which is hardly the goal.
- gr4yb34rd 5y agoThe thing that always bothered me most about Grindr is the fact they do not allow any connectivity from VPNs, even if you have an upgraded account. This doesn't seem to jive well with the need for privacy or anonymity in places where it's dangerous to be gay.
- switch007 5y agoWorks with Mullvad (most of the time)
- tgsovlerkhgsel 5y agoOne thing I'm wondering with these fines is whether they are actually "dissuasive". In particular, the revenue limit seems problematic. For a "normal" company whose profit margin is a relatively small fraction of revenue, 4% of revenue is huge. But for highly profitable large tech companies that make money primarily from ads, it may not be possible to issue a dissuasive fine if it is capped to 4% of revenue. Maybe "4% of revenue, or 200% of profit, whichever is higher" would be a better limit.
- jacquesm 5y agoThe first fine, usually not. But that fine indicates that regulators have reached a level of pretty serious frustration at a company not doing enough. Second fines are at the level that you'll be talking about them in the board room on how you managed to mess this up so colossally. I haven't seen any third fines yet, but I'm pretty sure we'll see one in 2022 or 2023. And likely the company that is in luck will go right out of business. And after that I expect compliance will be a much easier subject. So far the whole roll-out has been exactly as I expected it to be.
- tgsovlerkhgsel 5y agoMy point though is that the maximum fines they can hand out, even for the third offense, are so low that they can't really give effective fines to some companies (unless they apply such a fine e.g. per user whose rights were violated, which doesn't seem to be what they're doing). Grindr made a profit of $31M and a revenue of "well over $100M". The maximum fine is 20M EUR or 4% of revenue (whichever is higher). So assuming under 500M EUR in revenue, the maximum fine is lower than Grindr's 2019 profit. So if Grindr is the lucky one that serves as an example, I don't see how even the absolute worst case fine would put them out of business. Although the max fine is probably higher than the 2019 profit from the EU, I could totally see that changing, and someone deciding that getting slapped with the maximum fine is cheaper than the loss of revenue from complying, especially if it is a business that is entirely in ads.
- tmarice 5y agoGrindr is incorporated in the US, I'm not sure how they plan to enforce this fine.
- kristopolous 5y agoIANAL but the lawyers I've worked with have said unpaid violations lead to cutting off business relations until fines are satisfied. I'm sure it's more complicated but the general idea is economic coercion. Now given that, the class of proximity based apps are all regional (such as dating, dog walking, delivery, etc). I have no idea if Grindr has a market penetration in Europe to make it worthwhile. Companies have been known to completely vacate markets instead of honor fines or fees.
- ryanlol 5y agoAs if grindr doesn’t collect any payments in Europe or have executives who enjoy their ability to travel.
- leodriesch 5y agoThe EU operations of Grindr have to follow European laws and will therefore have to pay the fee or leave the European market. If they won’t leave or pay, the EU could possibly force app stores to remove the app from their region or something similar.
- simion314 5y ago>Grindr is incorporated in the US, I'm not sure how they plan to enforce this fine. You put the company on a black list, then banks or other companies in EU or that have business in EU can't send them money or work with them, I am assuming they offer some subscriptions and other paid features so the banks not working with them will hurt.
- fulafel 5y agoMaybe someone for Norway can pitch in about how this works. Even though Norway is not a EU country, it's part of the EEA and various other treaties with the EU and hence they ended up implementing GDPR, it seems possible that they end up being having authority to enact EU/EEA wide enforcement actions.
- keewee7 5y agoMaybe it's time that frameworks like Django and Rails make it easier to be GDPR compliant from day 1. ASP.NET Core has APIs and templates for this: https://docs.microsoft.com/en-us/aspnet/core/security/gdpr?view=aspnetcore-6.0 https://docs.microsoft.com/en-us/aspnet/core/security/gdpr?v...
- nlitened 5y agoMaybe it’s time companies stop hoarding and reselling users’ personal data. These built-in templates for cookie popups are a joke, IMO.
- donarb 5y ago> Maybe it's time that frameworks like Django and Rails make it easier to be GDPR compliant from day 1 The first step in being GDPR compliant is not installing a tracking library in your project. Web frameworks have no control over that.
- lobocinza 5y agoSomewhat related. Not long after creating a Tinder account using an unique mail address I received a phishing mail on that address.
- denton-scratch 5y ago> I received a phishing mail I was on Tinder for about a week. I was receiving dating spam for a year - not "a phishing email". Hopefully Tinder will be the next up against the wall. They're shameless.
- crazy1van 5y agoUnfortunately, data collection and data sales (either of the data directly or via targeted ads) is how many modern internet companies generate revenue. It’s easy to claim that they should just charge money directly for their product but their would-be customers seem to rather pay with their data than a monthly fee. In fact, anecdotally, it’s often the vocal critics of data-funded tech companies who post an archive.is version of every paywalled article.
- xemoka 5y agoOh man, that’s such a false equivalency. Because someone thinks journalism should be done in the open, particularly when the topic of commentary, doesn’t mean they want their private information (location, sex partners, whatever) sold to the highest bidder without their informed consent.
- cblconfederate 5y agothat is attacking a strawman that the comment did not make. It IS a paradox that people want information to be free but not if other people use it for advertising.
- NelsonMinar 5y agoGrindr is a repeat offender, globally. In 2018 researchers found that Grindr was sharing users' HIV status and location with marketing companies: https://www.buzzfeednews.com/article/azeenghorayshi/grindr-hiv-status-privacy#.dyPk9w3bW https://www.buzzfeednews.com/article/azeenghorayshi/grindr-h... Just this year there was a scandal where an anti-gay church fired one of its officials because a homophobic publication somehow got access to his Grindr account and his location data. The details on how the data got out are not clear. https://www.vice.com/en/article/pkbxp8/grindr-location-data-priest-weaponization-app https://www.vice.com/en/article/pkbxp8/grindr-location-data-...
- mistrial9 5y agoFrom a systems point of view, the "boiling over" of agitated Grindrs data is no surprise as the source of obvious data abuse, similar to the way that the data on compulsive gamblers is used and abused, I suspect. Yet this is only a tip of an iceburg. In My Own Opoinion - this "surveillance capitalism" is a huge, stinking cancer on free society and is only getting started.. history will show this is absolutely true. "I have nothing to hide" people can get a free Grindr subscription for all I care.. this is a rotten situation.
- temptemptemp111 5y ago
- deleted 5y ago[deleted]