Are the ad firms who buy this data immune to prosecution? Is legal to buy or own data if it's illegal to sell?
I'd hope that it's equally dangerous for both the buyers and sellers of this kind of data.
It's broadly illegal to hold personal data without an consented purpose under GDPR and DPA.
The only excuse the ad firm could have is if they have sought and received consent in the past and the user has ignored the wall of text and clicked agree. Which is entirely possible.
That said, the law revolves around the idea of legitimate use of data. DPA 2018 also has restrictions and extra hurdles for the processing and storing of medical data.
I don't think Grindr will have a legitimate cause to pass on that data to advertisers, even if they do need to store it and pass it onto prospective matches. I don't think the advertiser will have cause to collect the data (even if they asked) but I don't think any of this is as clear cut as it first seems.
