The privacy regulator found that Grindr violated article 58 of the General Data Protection Regulation by: "Having disclosed personal data to third party advertisers without a legal basis"; "Having disclosed special category personal data to third party advertisers without a valid exemption from the prohibition in article 9(1) GDPR," which provides exemptions for certain types of data, none of which are for advertising purposes. Article 58 of GDPR (Source: EUR-Lex) A Grindr spokeswoman tells Information Security Media Group: "The allegations from the Norwegian Data Protection Authority date back to 2018 and do not reflect Grindr's current privacy policy or practices. We continually enhance our privacy practices in consideration of evolving privacy laws and regulations and look forward to entering into a productive dialogue with the Norwegian Data Protection Authority."