Grindr to be fined almost €10M over GDPR complaint
noyb.eu
noyb.eu
This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options to opt in to specific forms of tracking which. Most of those are now off by default, as it should be, except that if you scroll down you still see a number of "legitimate interest" ones enabled, even though you can turn them off manually.
Edit: And worst of all is this very confusing pattern with two columns of toggle buttons, one of which concerns "legitimate interest": https://toot.cafe/@peter/105367185171860458
I do get that this type of regulation is very disruptive to many companies, but if they cannot survive with informed consent, then perhaps they should not have been so successful without it in the first place.
IMO it would be fine to say "we were tracking you but when you followed the link we deleted those cookies and won't now set them". "Reject all", or default off ("no cookies are set, cock here to enable the committee types you wish") is better.
What's far worse is the admission that they still use ad networks even when those networks are clearly breaking the law (ie they offer no settings to disable tracking). Indeed BBC should be going further and not allowing advertisers on their network to drop cookies if a user has disabled first-party cookies. Instead they say "go to these networks and disable it yourself", good luck with that!
This from an org funded in [minor] part by taxation and whose rausin d'etre is supposed to be serving the public interest.
It's sneaky, immoral, unethical and illegal. It also works.
*"stupid" is relative term. Laws are made for particular society, if almost a half of that society disagrees with the rule then it shouldn't be a rule.
And I don't think it's a fair statement that any large percentage of _people_ oppose this particular law; in my experience, most people don't seem to have a strong opinion about it, and those that do have a strong negative opinion very often don't really understand it (and are mostly reacting to the irritation that the various stakeholders are deliberately putting them through). Sampling the opinion of companies that live off ads is a bit like asking printer companies how they feel about toner prices.
So great laws actually even if gets 100% of those.
These dark patterns we keep seeing shows that the sites didn't do their homework and is trying the usual weazel way of getting past on "you clicked accept so now you are stuck.". Consent can only be given knowingly, if you hide it in the fineprint (or behind a "show more" button) it's not valid according to GDPR. To invent things like selling customer data to third party and call it fair usage of private data is not ok either.
The agreement has to be easy to understand and very short. And it has to be presented close to the actual entering of data or the accept button. No hiding, no shenanigans, no trying to fool with colors or design. It's that simple.
I completely agree. People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy. If a “pitiful” fine of $200,000 fixes the behavior, why fine the living daylights out of them?
I’m just wondering why the fines have been so “slow” to happen. Enforcement Tracker[0] lists only 533 of which the majority appear to be against individuals (such as “Doctor”, “Private person”, etc.) I just figured there would be more by this point.
As a person who calls for these, my reasoning isn't that they should dismantle the entire web because of it[0] - but that destroying a few small businesses and seriously hurting some big ones would set an example for all the rest to fall in line. Right now, companies seem to correctly reason that they're statistically unlikely to be noticed and fined.
--
[0] - Even though my belief is that advertising industry in particular is a social cancer and absolutely needs to be torched down to the ground.
Constantly applying fines is not sustainable. You eventually want to get to the point where privacy "just happens".
It’s as if they used decades of HCI research precisely to make the user experience as horrible as possible. No wait, I’m sure they did exactly that.
For all the hate that Yahoo gets for theirs (shown above), at least it does have a mostly functional reject all function, even if it requires two button presses (the end of the footer does tell you to go manually opt out of facebook/twitter).
It's honestly absurd the amount of different dark patterns they're using to try to trick users.
“TrustArc” is a funny name considering it and its pals have obliterated any trust I had in this stuff.
No one likes to be blatantly manipulated.
There need to be fines for this. They're clearly violating the spirit of the law, if not the exact letter (and I think much of Europe has legal systems that follow the spirit more than the letter, don't they?)
Article 7 (3) 4. https://gdpr-info.eu/art-7-gdpr/
I'm in favor of a lot more fines, and substantial fines. Few companies need to be made example of. The current situation does further damage to how EU citizens perceive GDPR and EU itself - companies do their best to make the consent control experience as bad and tiresome as possible, and then they tell people to blame GDPR for how web browsing just got more annoying.
A few more GDPR fines and that hole will also be plugged. :)
These fake progress spinners are only there to deter you from opting out (hint: if you just accept all, the modal closes instantly).
I wish the EU would throw massive fines at these companies, and ban the persons in charge from over working in the business again.
That example doesn't have the long loading times for me any more, but I'm almost certain it was the TrustArc pop-up.
The opt out cookie is set by the advertiser, not the publisher, and the contents of the cookie have generic text like "OPT OUT".
Not to mention that if there were any hypothetical API calls those could be made asynchronously after closing the modal.
It's purely a dark pattern.
If you did that, users wouldn't be able to see whether their opt out was successful.
Like the sibling poster said, the default should be opt-out.
It's not as if this TrustArc modal is some old product that was repurposed for GDPR. This is all planned and done in bad faith, period. It's a dark pattern.
That seems really wrong.
They'd need to queue those things and process them async later, or find a solution that doesn't need those requests at all.
So as long as you didn't interact with the banner, _every_ page load should take ~60s?
An acceptable option is to pop up a consent form as needed, and set a cookie recording whether user made a consent decision. That can be classified as essential cookie to fulfill a legal obligation.
Right now companies just keep doing what they always did and hope for the best. As long as they're convinced they can just try not to get too much attention this data sharing problem will persist with barely a dent.
It should be required by law that there be a simple to access “opt out to everything” option that should be as easy to access as an “opt in to everything” option.
Also, I would not be opposed if some browser standard were developed under governmental oversight that sends a blanket “opt out to everything” that websites would be required to respect by law.
It arguably is already required with the language of article 7.2 and recital 32, especially this part
> If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
But we will see how it gets interpreted as more cases works their way through the system.
The phrasing “The-opt-out-to-everything option must be as easily accessible as the opt-in-to-everything option.” is far less arguable and hiding one behind a further menu, but one not, is a clear violation of this rule.
That's pretty awful, how are you even supposed to interpret that? I'm guessing it's something like "first || !second", because that would be the sleaziest.
Some have an "accept all" button that could perhaps reveal which is "on" and which is "off", since when you press it all the buttons go to "on". But this happens so quickly and the modal is closed immediately afterwards, that there's no time to tell. And of course by then you've already accepted so it doesn't matter.
It reminds me of "reasonable" wording in English law.
Taking a page from the RealNetworks playbook from twenty years ago, I see. Put the shit you don't care about up top and unchecked, keeping the interesting stuff checked but below the fold.
I have heard of their lawsuits against Apple, Facebook and now a large fine against Grindr.
If anyone wants to help them - https://noyb.eu/en/support-us . (no affiliation)
It's mainly EU-centric which might be the reason why people here haven't heard of it before.
It also caught my eye that their TOS didn't allow users a choice in data sharing, it was either agree or don't use the app. That might have some wide ramifications, I've encountered many web sites that won't let you past the sharing opt-in until you click agree - i.e. it is impossible to disagree. It is a completely foreign concept for US companies.
Wikipedia says Grindr is based in California, US. I wonder if they will pay the fine or refuse. If they have no assets in Norway I imagine it may be hard to collect from them.
Opera is still headquartered in Norway. Don't know if that helps, but there may be interesting corporate associations there.
I thought, but have never verified, that fines given as GDPR enforcement can be collected throughout the EU/EEA. If this is true, and if European courts uphold the fines when Grindr undoubtedly challenge them, then it's my understanding that the Norwegian DPA can have Grindr assets elsewhere in the EEA seized.
Does anyone know for sure?
If the Norwegian DPA is the one handling this case, probably that's because Grindr's EU operations are legally established in Norway. If they don't have an "establishment" in the EU, then I think it's up-for-grabs, and my gut is that NOYB would have preferred to file in France or Germany.
This is why GDPR actions against Facebook, Google, etc. all go through the (under-resourced) Irish DPA: US companies are all based there for tax reasons. It's... becoming a problem.
I have a relative who is a lawyer and legal attorney who would definitely not know this and when asked would answer that it is not his speciality and that he would have to do more research.
He's an attorney in employment law, and I asked him some things about criminal law and he did not know, and when pressed to make a guess, his guess was wrong.
It seems that law is quite complicated, and that lawyers have their specialities.
[1]: https://www.forbrukerradet.no/news-in-english/historic-victo...
[2]: https://www.forbrukerradet.no/side/new-study-the-advertising...
A bit ironic, for a dating app.
They seem somewhat scary to me, in that anyone one knows might encounter one on it.
[1] https://en.wikipedia.org/wiki/Match_Group#Dating_services_ow...
You may be using a slightly expansive definition of 'small company'.
You do know that GDPR fines scale with revenue?
Grindr presents me the third party data choice dialog every day. Sometimes multiple times per day. I reject every time. Also, it forgets that I set my units to metric regularly. Grindr is a mess. Besides it big user base, it is a garbage app.
Especially for private information regarding ones health and sexual activity.
> Authority imposes a fine of 100 Mio NOK (€ 9.63 Mio or $ 11.69 Mio) on Grindr. An enormous fine, as Grindr only reported a profit of $ 31 Mio in 2019 - a third of which is now gone.
Did they reduce CEO income by 30%? I'd be impressed if they had. Mind you some CEOs take 1000× median income so 30% is still pretty unlikely to hurt them (but I don't know the relevant details in this case).
It needed to be big enough to make it cheaper to comply than not. I believe it achieved that purpose. Anything else is just revenge.
>Consent must also be freely given. The DPA highlighted that users should have a real choice not to consent without any negative consequences. Grindr made use of the app conditional on consenting to data sharing or to paying a subscription fee.
I thought that this was allowed. Kind of puts companies depending on advertising in really bad position. One would expect that having choice of paying or getting tracked would be, at least for some people, better than just having to pay to get to the content.
Good. I hope these companies die. This business model is more toxic than Dow Chemical.
I recently stopped thinking of myself as an Internet user on the web but rather an advertising ID holder.
If only one company does it, they lose. But if everyone is forced to do it, noone will lose.
It's also not a zero sum at all. An advertisement that is not within the user's interest is wasted, rather than going to the competitor.
Not completely, if there is anything to the concept of "brand awareness" (and I believe there is, and a good chunk of advertisers do too). An ad that is not within user's interest still makes an imprint of the brand, product and vendor in their head. Later on, where user's interest change, that brand/product/vendor is a bit more likely to be recalled by them. A mistargeted ad is better than no ad at all.
Has anyone actually compared this over long stretches of time and compared apples to apples, not apples to oranges?
Additionally, most people don't want personalized ads based on tracking: https://www.emarketer.com/content/do-people-actually-want-pe...
I'm sure customers also don't want planned obsolescence. — it is very good for business, however.
I think race to the bottom deserves to be its own type of "planned obsolescence" (again, not mentioned in the Wikipedia classification). While in a highly competitive market, the design process may boil down to "do the same as competitor X, but slightly cheaper" instead of explicitly setting the durability target low, the end result is the same - products that have no business existing enter the market, live very briefly, and forever enter the waste stream. It's a systemic problem, and it's planned in the sense that if you enter such a market, you've already decided to create short-lived trash.
--
[0] - https://en.wikipedia.org/wiki/Planned_obsolescence#Types
No, that's one of the big wins of GDPR. You cannot just force the users to sign away their rights.
You may or may not agree on whether the right to privacy should be on the same level as the right to vote, but other than that, it's really the same principle.
Too bad the big bad governement regulation prevent me from selling it. It's absolutely ridiculous, all my customers wants it and I pay my taxes.
Look, I understand if you feel "privacy rights" and "voting rights" are not in the same class of rights, I even mentioned explicitly that even though the same principle applies, you may not agree they're comparable. But you can't deny that the only reason voting rights are not transferable is because we said so - we have laws that dictate "voting rights are not transferable". It's easy to imagine a world where voting rights would, in fact, be transferable. It's just as easy to imagine a world where advertisers don't have the right to build a profile about you.
What is happening now is that we started with a world where (online) privacy rights were non-existent, and laws like GDPR are aiming to change that. You may not agree with the change, but others do, and it's a legitimate sentiment to have. It's not necessarily outrageous to want to "impose on everybody" my view of privacy rights. No more than it was to "impose on everybody" the view that e.g. women should be allowed to vote.
[+]https://theconversation.com/shadow-profiles-facebook-knows-a...
What you are suggesting is not like "women should be allowed to vote" it's akin to "women must vote".
> sharing users' personal data, something that influences only them
It does not influence only them, and I gave you an example. Also, I don't care what's FB's business model, I advocate that nobody should have an automatic right to build user profiles. I explicitly advocate that you should not have the right to demand payment in "data" because privacy should not be considered currency. Is that a strawman? I thought that was your entire argument "people should be free to decide to pay with their data!". NO THEY SHOULD NOT. Data is not currency, just like votes are not currency. You ask for currency, if you need payment - you don't ask for profile data.
> it's akin to "women must vote".
Well, it's an analogy, if you don't find it useful, let's drop it. The gist of it is, I feel very strongly that we should legislate that privacy is not currency, you seem to feel otherwise. It is fine to disagree, but it doesn't make my position irrational or absurd in any way. Yes, I feel that allowing people to pay with privacy _is_ exactly "taking their rights away", in the same way that allowing them to pay with their voting rights would be.
But none of that seemed to be relevant to the Grindr fine. And one thing I should have probably mentioned before - I don't know Grindr and how the subscription works there, but my opinion on paying(subscription) vs giving data away would also depend if there were additional features granted in the subscription (now thinking about it probably yes) or not. This would in my opinion qualify as forcing user into paying even for thing he might not necessarily want to just to protect own privacy.
Also, prior to GDPR, the "pay with your data" aspect wasn't even mentioned by the companies. Ultimately, GDPR doesn't prevent people from donating their data - it just requires that it's explicit and not mandatory.
Below are excerpts run via Google Translate. I'm truly very surprised by what I just saw - the directness and honesty of communications is even more refreshing than privacy-friendliness itself. Their FAQ covers privacy and advertising concerns separately, and is very specific. If I had a need for German-language news, I'd subscribe to this just as a token of appreciation.
--
[0] - "We continue to advertise our own products discreetly because SPIEGEL readers expect information about new products from the company. We cannot technically remove advertising from podcasts and our digital edition, but this is played without tracking. Individual sponsorships are just as difficult to fade out, and separate page areas such as voucher and sports betting marketplaces that are independently offered by the providers there are only to be made inaccessible in the navigation of our journalistic offers - but not, for example, for searches from outside. This is the level at which the exceptions move."
[1] - "We depend on it [internal usage measurements] for both basic control and further development of the news site, especially in order to optimize our payment model: Which texts are of interest to readers, where do operating elements not work, which pay offer might interest a reader and which rather not?"
[2] - "What data does DER SPIEGEL collect from PUR subscribers? The customary reach comparisons and usage statistics for the control and optimization of the site, especially via our first-party service provider Adobe." - I'm not sure what they mean by Adobe being a "first-party service provider", but I don't like it collecting anything.
--
EDIT: here [3] is a list of cookies they set for PUR subscribers. Seems to be true to their word (and it's nice this list wasn't hard to find in the first place), but I'm worried about the presence of Outbrain on that list. I can't imagine any legitimate interest a third-party chumbox provider would have.
--
[3] - https://odbdegi64ni2b3m74jattyok7i--www-spiegel-de.translate...
If Grinder was fined 10% of revenue - why exactly aren't they fining Facebook 2.2 billion? It'd be much more impactful, and hopefully help put an end to those practices.
Further, there are still people living in the closet here, afraid to come out for fear of being disowned by their family or ostracized by their community. Grindr plays a double-edged sword here, because on the one hand it gives people a chance to meet others, but it also creates a risk of them being outed. --That makes people vulnerable to blackmail.
It's no different to straight people's sex lives, I'm sure many people wouldn't want it to be common knowledge what they're into, and who they've slept with
Anything from getting shunned by family members or religious community, losing out on job offers, to foreigners visiting Norway from a country where their sexual orientation is punishable by law.
There are plenty of soft barriers to progress for gay men.
This is what I've seen cited as a reason multiple times. I have no reference to point to, maybe someone else does?
Are there published stats you're referencing?
But perhaps the same reluctance to acknowledge those who seek homosexual relationships is present in people who call themselves gay, they won't acknowledge people as bi? Which seems like hypocritical bias against people whose behaviours are bisexual.
Maybe the behaviour you call out is because people want to have homosexual sex without being 'gay'. By which I mean without making that sexual activity the focus of their identity (I believe it's known as MSM)? It need not have anything particularly to do with societal disapproval.
Who one has sex with, and defining oneself by ones sexuality are quite distinct, as too are sexual desire and desire for relationships.
I'm interested in your response?
Young people sometimes use the word "gay" to express a complex sexuality which doesn't categorise neatly with a label. It's understood that you can be both "gay" and "bi" simultaneously, or indeed you can be a man who has sex with men who is straight.
The only person in this chat who is trying to put strict labels based on behaviour is you (the other commenter only observed some behaviour without labelling), so it seems like you're arguing with yourself?
Besides that, dating apps of any kind should be held to very high data protection standards for the sometimes very delicate matters.
Has everyone just decided that words have no meaning anymore?
As long as people have to fear getting kicked out, disowned, subject to slurs, or otherwise being ostracized by their family, friends, or community for being gay, lesbian, bi, or trans, then yes, the LGBT community remains vulnerable. And once you've been vulnerable like that, it never goes away. There will ALWAYS be a part of you that remembers it and it will affect you for the rest of your life.
That alone is enough vulnerability. The fact that the LGBT community still deals with a lot of verbal and physical assaults as well just makes things worse. And yes, this is still an issue in the UK, in Norway, the US, and other western countries.
What if a person lives near racists, people who keep directing hate at hindus because of their (unjustified) hate against muslims? They may feel unsafe if people knew they were hindu no matter the area of the world
It's good that you don't feel threatened, but unfortunately not everyone is so lucky. And we should respect people who want to keep any aspect of their lives private.
Yes. It seems a lovely social media trend. And on instagram many (most?) people don't seem to actually be able to use words, only emoji's. Not sure if that's worse or better.
This whole case seems to revolve around whether the 'Legitimate Interest' legal basis is valid or not. It was only a matter of time before it was legally challenged.
Without making a judgement on the merits of the approach, as a user/individual I appreciate the power this gives to protect my data. As a company/developer the conplexity of navigating the landmines that this poses makes me understand why a lot non EU companies decide to just block EU users. Is it "good riddance " in both cases? Maybe, but still the fact that innovating becomes more expensive sits there.
You can offer the user the choice between targeted advertising or non-targeted. You can offer the user the choice between paid subscription or advertising.
Cant get enough users to pay or consent ? Then you did not find market-fit in the real world.
You have to handle a "right to be forgotten" query within a month, surely this is enough time for one sysop to run a prepared query. If your database is so byzantine that you cant find all reference to a given customer, you are either google or in need of a new architect.
Backups do not need to be deleted immediately, they should however expires and be destroyed in accordance to your data retention policy (Say what you do, do as you say).
We both know rules are extremely clear and simple. They get complicated when companies try to go around them.
The only places I've seen actually do this are local newspapers in the US. Are there many other substantial companies doing this?
In general, dropping the EU is an expensive game: it's 450 million people, including many rich developed countries. GDPR doesn't mean you can't advertise or do other freemium upselling, it just means you can't precisely track people's personal data to do so, and the rules for that are fairly common sense & clear imo. It's not difficult for most businesses to make good money and stay inside the rules.
I'd rather not interact with a company that disrespects my privacy and it's rather helpful they have to tell me this up front.
I'm not even sure why GDPR is so foreign to the US. Think HIPAA for everyone, not just healthcare providers.
You have to be able to use the site without giving consent too.
https://www.lexology.com/library/detail.aspx?g=34dfb199-c9ab...
We have the option to reject certain EU-rules, and can negotiate special exemptions into our agreement. Norway has some exemptions in fishing rights that are central to our agreement. Under the previous government we also rejected the EU Postal Directive, though the current government has since accepted it.
> The EEA Agreement does not cover the following EU policies: common agriculture and fisheries policies (although the EEA Agreement contains provisions on trade in agricultural and fish products); customs union; common trade policy; common foreign and security policy; justice and home affairs (the EEA EFTA States are however part of the Schengen area); direct and indirect taxation; or economic and monetary union.
See section 5, "What is not covered by the EEA Agreement?": https://www.efta.int/eea/eea-agreement/eea-basic-features
It seems to be a pretty good partnership so far, and I did not read anything about a will from either side to change anything about it yet, but I might be misinformed
It's not well known, but all EU countries are required to adopt the Euro (except for Denmark who have a real opt-out). The countries who haven't are using a loophole to bypass the requirement of Euro adoption, by purposefully failing to fulfill some standards.
The only place in Norway Polar bears live is Svalbard, far North of the mainland. Most Norwegians have never visited because it's far away (a 1h 40m flight North from Tromsø in Northern Norway - similar to how long it takes to fly South to Central Europe from Oslo) and way too cold and miserable.
Seal is something few people eat very often. A huge proportion of the population will never ever have tasted it. Like whale, it's uncommon these days.
Your image of Norway may be a bit off..
It's true though that Norway is overly protective of its food industry. And arguably for good reason since it wouldn't be competitive at all if integrated with the rest of Europe.
As for seals, I've eaten seal, I think, but it's hardly been a dietary mainstay... We used to have whale regularly when I was a kid, mostly because back then it was much cheaper than beef (and much tougher, and oily... it was not great meat - it's expensive now due to low supply and nostalgia).
It's still largely politically untenable in Norway to oppose agriculture subsidies.
Today the main reminder is that Norwegian school children still tend to learn the epic poem "Terje Vigen" by Ibsen, about a man who braves the blockade to feed his family and is captured - coupled with food security being a talking point in other subjects. It's not pushed very hard, and many probably at this point don't even make the connection.
The main modern justification is WW2, where the subject of food security gets reinforced with stories of bread made with bark etc., and post-war rationing.
Couple that with the constant fear of the Soviet Union (to the point that when growing up, we had regular air raid siren tests - today they're so rare the newspapers write articles to explain what they are) only reducing to unease about Russia, and food security is still a political topic.
Personally I don't mind the sirens, they tend to work pretty reliably and every time the mobile phone network was used to indicate something was up for some reason I totally missed the message, never received it or received it more than a day later.
EDIT: That's not to say Norway doesn't still do whaling, but quotas are only for minke whales. Of a quota of 1278 for 2019, 429 where caught. But pilot whales explicitly still do not meet the conditions required (size of population etc.) for Norway to allow hunt.
E.g. Switzerland can still have customs and charge customs charges on some items.
This is incorrect. And the presence or absence of these checks is not a EU/EEA matter. The passport free movement is a matter of the Schengen agreement. This is why the UK had passport checks with most of continental Europe back when they were EU members (but not Schengen members).
Norway is a Schengen member, and an EEA member, but not an EU member.
This Venn diagram might help (note that it hasn't been updated for Brexit): https://upload.wikimedia.org/wikipedia/commons/3/3c/Supranat...
You are right about Schengen.
But I had to show my passport a couple of years ago on a flight from Vienna to Norway, so I thought they weren't part of Schengen. I'm not sure why, but I believe the reason must have been the "temporary border controls" introduced in 2015.
Ah, even Croatia is outside the EU on the diagram - so it's way worse than that. That being said: Croatia is outside Schengen as well.
The passport checks have nothing to do with the EU, it's the Schengen treaty[0] that allows omitting that part. Norway is a part of the treaty, so is Iceland for example. Some EU countries still don't meet the criteria to join, e.g. Romania, Bulgaria. Ireland and the UK are/were outside (voluntarily) of the treaty as well - which is one of the weirdest parts of the Brexit with the UK actually checking its own borders more than most of the rest of the EU.
For example traveling from Poland to Norway by car (and ferry Tallinn - Helsinki) requires zero passport/id card checks. (id cards are a valid traveling document within the EU and Schengen)
Except countries in the Nordic Passport Union: https://en.wikipedia.org/wiki/Nordic_Passport_Union You need zero documents to travel between these (well, you need a ticket if you fly or travel by train or a bus).
I flew to Norway from Stockholm before 2015, and I was very surprised to just pass directly to the gate (and same on the way back).
Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service?
The article goes on to say: "Grindr made use of the app conditional on consenting to data sharing or to paying a subscription fee."
Is this the unacceptable part? I.e. Grindr is creating a financial penalty for users who exercise their data privacy rights?
Would it be acceptable under GDPR to run an app where the choice is "consent to sharing data or do not use this app at all"?
When you actively share data with others, consent to process the data for this implicit. So as I understand it, a dating app would not need your explicit consent to share a profile photo with others on the platform since that is the whole point of the app.
But if the service decides to provide your personal data to advertisers, explicit consent is required, since that is not essential for providing the service. The service could just as well show anonymous ads, or target ads without tracking the user.
In this case the issue was that the consent was not informed. That is, Grindr weren't making it clear enough that the highly personal information they collected was then shared with hundreds of advertising partners.
GDPR literally says that you're allowed to run a service that requires data and you don't even have to ask for consent for that type of data.
What you're not allowed is to collect data that's NOT critical for your service without consent.
> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
So it does sound to me like you can't tie data sharing to provision of service because then consent is not freely given.
Also:
> Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. https://gdpr.eu/Recital-43-Freely-given-consent
I think this means that even if Grindr obtains consent the way they do, it's still not freely given consent so even having obtained it they still don't have permission to use the data the way they want, since only freely given consent counts as consent. But I'm not sure, maybe it's more complicated.
This has a pretty wide impact, I'd say.
Grindr actually distributed data from persons that had opted-out, reasoning that setting a flag should stop the down-stream processors from touching the data. That is literally the gossip girl using the the "don't tell anyone this" principle of privacy protection!
But Grindr and applications developers in general are responsible for the data. They have to know and have a data policy with their third parties.
You always had "respect the privacy of users" as a reason not to use them before, but we all know how well that worked.
The whole point of Facebook login and like was to collect data from unsuspecting users. Devs and product managers didn't care. GDPR makes this "laisser faire" attitude expensive.
Pretty shocking and absurd.
If I understand this correctly, it is not a problem, or a lesser or different problem if such a company share that a client finds being stroked on his earlobes to be highly arousing, or is a big aficionado of the “big black cock”, as those are not “sexual orientations”?
That seems like a rather arbitrary distinction I am not used to from E.U. regulations.
P.s.: I see that someone else quoted “data concerning a natural person’s sex life or sexual orientation”, — which is already significantly less arbitrary; the “or sexual orientation” is merely a superfluous inclusive.
It's section 9 "Processing of special categories of personal data"
https://gdpr-info.eu/art-9-gdpr/
> 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited
> 2. Paragraph 1 shall not apply if one of the following applies:
> (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
> (...)
I still find that quite arbitrary to make that distinction, not to mention the wiggle room it leaves with many of those categories being rather ill-defined.
At what point does an opinion become “political”? what is “racial” an “ethnic origin” is quite open to interpretation; when is a belief “philosophical”?
The way I understand this paragraph, it could conceivably be so that an opinion that, say, consoles are not suited for f.p.s. games could freely be processed, but an opinion that U.K. roads are unsuitable for cycling could not, as the latter would be more easily classified as “political” even though the former could too, and the later could conceivably not as well?
I find that very arbitrary.
No. That list are data that are considered especially sensitive, and so it's generally prohibited to process personal data of this kind. As far as I can tell it's the strictest part of the GDPR, so it's probably also the easiest to enforce.
If some data doesn't fall into these "special categories", the rest of the GDPR still applies. The GDPR applies to any data linked to natural persons.
I find this distinction to be bereft of a proper justification. As I said elsewhere, I cannot think of any salient reason to not cover name and address as a means to identify a person, but do cover far more obscure and unlikely biometric data.
It should not be protected in any different way.
For example, the GDPR emphasizes the "right to be forgotten". If something bad happened to you, you may not want to be forever defined by that event. A kidnapped person might not want to be forever known as just a crime victim. So they can ask Google to remove mentions of their name, and they can even legally change their name as a last resort.
But if eg. Facebook stored their face measurements and then automatically tagged them in a newly uploaded photo all that would be pointless.
So it makes sense to treat certain data as more sensitive.
At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?").
Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data.
I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much.
It would be absolutely trivial to implement a system where one might requæst a randomly generated code with the postal service, that can be placed on a letter that maps to one's real address, except of course, that the real address cannot be retrieved from it, which is hidden with the postal service.
With such a trivial scheme, it would be possible to receive mail without having to leak one's place of residence to the sender, simply give them such a code, which could even be set to expire within a set timeframe, at which point the postal service deletes the connexion to one's real address, for fear their data be leaked.
It's trivial; it's of far greater importance than the sensitivity of biometric data, yet it is not there.
I can only gander it's not, because the E.U. is extremely arbitrary at what points it cares about one's privacy. Name and address are absolutely, as I argued elsewhere, some of the most sensitive data available, and there are trivial measures that could be taken to secure it better, yet these are not implemented, for the E.U. is extremely arbitrary and not rational in it's decisions.
You can rent a "post box" for letters or packages. You pay a monthly fee and get a post box number. You provide your post box number instead of the address, and then you can pick up your mail from the post office.
They also have a forwarding service. Same thing but they deliver it to your home.
Also, many online stores let you deliver directly to a post office or even to self service pick up stations.
So there are ways to shop online without providing your address. But these services are not used very much. I guess most people don't care as much about the secrecy of their address.
I cannot change my name so easily as far as the Dutch government is concerned as well as that of many other European countries. I need a reason of significance and a simple “I wish to be forgotten and start a new life.” is not accepted, as it is in many European countries.
If the E.U. cared so much about this, it would mandate that it's member states permit easier name changes.
Simply put, it is easier for me in the Netherlands to have plastic surgery and change my biometric data, than it is for me to change my name so I am holly unconvinced by this argument and it seems ad-hoc to justify what is purely an irrational distinction.
> At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?").
There are already exceptions in place in the law where data may be collected if it be essential for operations.
As it stands, companies may ask for my name and address when they have no need for it to process anything, this information can surely be used to uniquely triangulate my identity with little effort, far more effort would be required to do so with a picture of my face, or a scan of my retina.
This seems highly arbitrary and ineffective to me. I remain very much unconvinced that this distinction is one that was given any serious thought.
> Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data.
It is far, far more sensitive.
Would you rather that your name and address be placed on H.N., or that your fingerprints or retinal pattern end up here? Would you rather a stalker have the former or the latter?
To triangulate a man's identity from biometric data requires specialized equipment, to do so from name and address is a trivial endeavor a layman can undertake.
> I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much.
I do not. I find the distinction made here to be completely arbitrary and undeniable that name and address are far more sensitive and open to abuse than biometric data, the latter requiring specialized equipment to make use of.
Again, would you rather a stalker have your name and address, or your retinal scan?
How exactly does biometric data to identify a person, but not a name and address to do the same differ in how much it can be used to harm minorities?
They are both a means to uniquely triangulate the identity of a person, one is arbitrarily allowed but the other is not. It's as arbitrary as if not permitting murder with poisons, but permit it so long as it be done with a knife.
SELECT address AS to_harm WHERE sexual_orientation IN ('unusual');How can I tell minority status from a fingerprint or retinal scan?
It seems rather arbitrary to treat name and address differently from fingerprints.
I would argue that minority status correlates more heavily with name than with retinal patterns.
Of course, people don't have the same philosophical beliefs which is a pretty caveat to the whole argument.
> data concerning a natural person’s sex life or sexual orientation
is among the things with stricter rules under Article 9: https://gdpr-info.eu/art-9-gdpr/
How are investors reacting to this?
I see two potential outcomes:
1) Ad-supported apps will serve ads without hoarding personal data, e.g., a weight tracking app will show weight-loss ads to everyone.
2) We will see more paid apps.
Just as investors don't invest in companies doing financial fraud, I'm hoping investors will also do more due diligence on the privacy posture of their portfolio.
Collecting and publishing tax returns would fall under "public duty".
As another example, the post office is allowed to collect and process your address, since otherwise they could not fulfill their contract to deliver your parcel (contractual obligations).
Similarly, paramedics don't need to worry about asking for consent from a patient that is unconscious: They can look into their medical records based on "vital interests".
If data sharing was conditioned on not paying for the app use, than this could be against what this forum usually stand for.
I, too, will happily pay for my data being not used and seeing no ads.
Wee need more details about this case.
These are two different things, sharing data and displaying ads. The ad industry has forgotten that you can advertise without collecting hoardes of personal data, and they've convinced the rest of us that it can't be done.
The point here is that sharing data in the way Grindr is sharing it with third parties is not core to its business. That is, no one signs up for Grindr because of that functionality. Folks sign up to Grindr to find and message others. That functionality does not require the type of data sharing being reviewed in this case, and that sharing of data is distinct from merely displaying advertising.
In the cases of Smaato, OpenX and AdColony, Grindr “only” transmitted a signal conveying the data subject’s “opt-out” preference. We understand that advertising partners could choose to ignore that signal. In any case, Grindr would have to rely on the action of others, either the user, the operating system, Grindr’s partners, or a combination of the aforementioned, to halt its sharing of data where so required. In consequence, Grindr failed to control and take responsibility for their own data sharing, and the “opt-out” mechanism is not necessarily effective.
Furthermore, for a consent to be “freely given”, accepting to the particular processing operation should be as easy as declining, and the choice should be intuitive and fair.
[1]: https://www.datatilsynet.no/en/news/2021/intention-to-issue-... ("Advance notification of an administrative fine")