Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users.

While the decision concerns users in Norway, the data-sharing practices were not confined to Norwegian users. BleepingComputer reports that information about Grindr users in other countries was also exposed through the advertising system.

Between July 2018 and April 2020, Xandr handled real-time advertising auctions involving Grindr users. These automated auctions let advertisers bid to display an ad, but also involved circulating information about the person who would see it. Sensitive information revealing sexual orientation could potentially reach thousands of companies.

Crucially, users did not have to disclose their sexual orientation in their profiles. Datatilsynet said that simply being identified as a Grindr user was information that indicated sexual orientation.

According to the regulator, Xandr relied on Grindr to obtain consent without checking whether that consent was valid. As a company jointly responsible for the processing, Xandr had its own obligations. It was not enough to simply assume the app had obtained the explicit consent required.

This was not a case of hackers breaking into a dating app. The information was flowing through an advertising business without a valid legal basis. Privacy group noyb, which filed the complaint in cooperation with the Norwegian Consumer Council, says such systems use tracking identifiers to build profiles of people’s interests, habits, and behavior.

Are your details being used by cybercriminals? 

FIND OUT HERE

Although Xandr now belongs to Microsoft, the misconduct predates its acquisition. Microsoft completed its purchase of Xandr from AT&T on June 6, 2022, more than two years after the period covered by the fine. Microsoft told BleepingComputer it was reviewing the decision and assessing its options.

How to protect your privacy

This is a Norwegian enforcement action, but the data-sharing practices crossed borders. Users in the US and elsewhere shouldn’t assume their information stayed private just because the fine was issued in Norway.

You can limit how much additional information you disclose by giving a dating app only what you need to use it.

• Leave optional profile fields blank when the information feels too personal.
• Avoid publishing your workplace, home address, regular schedule, or other details that make you easy to locate.
• Review location permissions and advertising settings and limit them where possible.
• Think carefully before linking social accounts that reveal more of your identity.
• Don’t use dating apps on company-issued devices.

These precautions cannot guarantee privacy. Responsibility for unlawful sharing lies with the companies involved. This case shows that sensitive information can come from using the service itself, not just from what you write in your bio.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Here’s what we’ve covered in the last seven days on Malwarebytes Labs:

• Crypto customers targeted by scammers after email marketing provider breach
• Android malware creates a hidden copy of your banking app
• BlueMoon exploit kit turns Chrome and Windows flaws into attacks
• Will AI kill us all within the next decade?
• Update Chrome now to protect against an actively exploited vulnerability
• Copyright scammers get Instagram accounts suspended and demand payment
• More than 100,000 fake stores are out to steal your card details
• Microsoft fixes record 964 flaws, including 2 exploited zero-days
• The push to stop algorithms controlling social media feeds has begun
• Grindr settles HIV status data-sharing lawsuit for $35 million
• MikroTik router flaws allow takeover without a password
• Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)
• LG TV flaws could let attackers listen in, even in standby mode
• Flirty OnlyFans promoters on X may be using AI to appear human

Stay safe!

Grindr has reportedly agreed to pay £26 million (around $35 million) to settle a UK privacy lawsuit alleging that it shared sensitive user data, including some users’ HIV status, with advertisers.

The claim was brought by London law firm Austen Hays on behalf of roughly 12,000 UK Grindr users. It alleges that the dating app breached privacy and data-protection laws during a period ending in early 2020.

The claimants allege that Grindr shared personal and highly sensitive information with advertising companies without consent. According to Austen Hays, the shared data may have included ethnicity, HIV status, the date of a user’s last HIV test, and whether they used pre-exposure prophylaxis (PrEP).

At the time of the alleged data sharing practices, Grindr was owned and controlled by the Chinese gaming company Beijing Kunlun Tech. Grindr was sold to US owners in 2020.

According to a US regulatory filing, Grindr will make two payments of £13 million: one by December 31, 2026, and the second by March 31, 2027.

In its SEC filing, Grindr said that the settlement is not an admission of liability and, while it disputes the allegations, it:

recognizes and acknowledges the distress and loss of trust expressed by some of its UK users regarding that pre-2020 period.

The UK settlement follows a separate enforcement case in Norway. The country’s Data Protection Authority found that Grindr had shared users’ personal data with advertising partners for behavioral advertising without a valid legal basis.

These cases illustrate a crucial privacy point: information does not need to be explicitly labeled as medical information or information about sexual orientation to expose intimate details about someone. Advertising identifiers, IP addresses, locations, device information, and confirmation that a person uses a particular app can be combined to identify them or draw sensitive conclusions about their life.

Many free apps rely on advertising SDKs, analytics providers, and other third parties to make money. These integrations can receive identifiers and event data that help target or measure advertising, but they can also create extensive trails of user behavior.

How to protect your privacy on dating apps

Grindr says it has overhauled its privacy program since 2020 and remains committed to user control and responsible data practices. Even so, dating apps can hold unusually personal information about their users.

To limit what you reveal:

• Review the app’s privacy settings and turn off optional personalized advertising where available.
• Limit your profile to details you’re comfortable sharing with potential matches.
• Avoid linking a dating profile to public social-media accounts unless you want identities to be easily connected.
• Revoke location permissions when you’re not actively using the app, or choose “while using the app” rather than continuous access where your operating system offers it.
• Keep the app, your operating system, and your security software updated.
• Watch for romance scams and extortion attempts, particularly requests to move the conversation off the app, send money, share intimate photos, or reveal identifying information.

If you’re unsure whether a message may be part of a scam, you can check it with Malwarebytes Scam Guard, which can help you assess the conversation and decide what to do next.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.