Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that withdrawing consent applies only to future processing and that following an opt-out, sensitive or special-category data may continue to be processed where permitted under applicable law.
This analysis describes what Grindr's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a carve-out permitting continued processing of sensitive data after user opt-out under legal bases other than consent; the scope of those alternative legal bases is not enumerated in this clause, creating compliance questions regarding which processing purposes may continue without consent.
Interpretive note: The provision does not enumerate the specific legal bases that would support continued processing of sensitive data after opt-out, creating ambiguity about the scope of processing that may lawfully continue in each jurisdiction.
Under this clause, opting out of certain sensitive data uses does not guarantee cessation of all processing; the agreement states that sensitive data may continue to be processed where permitted under applicable law, and the specific legal bases that would support such continued processing are not enumerated in this provision.
Cross-platform context
See how other platforms handle Post-Opt-Out Sensitive Data Processing Carve-Out and similar clauses.
Compare across platforms →Monitoring
Grindr has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Where we process personal information based on your consent, you may withdraw that consent at any time. Withdrawing your consent will only apply to future processing activities and will not affect the lawfulness of any processing carried out before you withdrew your consent. For example, you may be able to withdraw your consent or opt out of certain uses of your 'sensitive' or 'special category' data by going to your in-app Settings and then tapping Privacy Settings. Note that if you opt out, your data may continue to be processed where permitted under applicable law.Excerpt from Grindr's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 7(3) (right to withdraw consent) and Article 9 (special-category data), which require that withdrawal of consent results in cessation of consent-based processing. Where Grindr relies on alternative legal bases (such as legitimate interests or legal obligations) to continue processing after opt-out, those bases must themselves be documented and valid under Article 9(2). Relevant enforcement authorities include EU member state DPAs and the UK ICO. The phrase 'where permitted under applicable law' is not defined in the provision, which may create tension with the specificity requirements of GDPR transparency obligations. 2. GOVERNANCE EXPOSURE: High. The absence of enumerated alternative legal bases for post-opt-out processing of special-category data creates documented uncertainty about the scope of continued processing following user opt-out, which may not align with GDPR transparency and data minimization principles. This language applies to health data (HIV status, vaccination status), racial/ethnic origin, and other sensitive fields. 3. JURISDICTION FLAGS: EU/EEA and UK create heightened exposure given GDPR Article 9 requirements. California CPRA imposes restrictions on the processing of sensitive personal information and requires opt-out mechanisms; the adequacy of the carve-out language under CPRA should be assessed. Washington My Health MY Data Act may impose stricter limitations on continued processing of consumer health data after opt-out. 4. CONTRACT AND VENDOR IMPLICATIONS: If sensitive data continues to flow to advertising or service provider partners following user opt-out under alternative legal bases, those partner contracts must reflect the applicable legal basis and processing restrictions. Procurement teams should verify that vendor agreements address post-opt-out processing obligations. 5. COMPLIANCE CONSIDERATIONS: Legal teams should document and map each legal basis that supports continued processing of special-category data following consent withdrawal, and ensure those bases are disclosed with sufficient specificity to meet GDPR transparency requirements. A consent mechanism audit should assess whether the current Ketch CMP implementation accurately reflects the scope of processing that continues after opt-out. Regulatory notifications or DPA consultations may be warranted where processing of sensitive data under legitimate interests is relied upon as an alternative to consent.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a carve-out permitting continued processing of sensitive data after user opt-out under legal bases other than consent; the scope of those alternative legal bases is not enumerated in this clause, creating compliance questions regarding which processing purposes may continue without consent.
Under this clause, opting out of certain sensitive data uses does not guarantee cessation of all processing; the agreement states that sensitive data may continue to be processed where permitted under applicable law, and the specific legal bases that would support such continued processing are not enumerated in this provision.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Grindr.