Norway fines Microsoft-owned Xandr $9.6 million over Grindr data sharing

Norway's Data Protection Authority, Datatilsynet, has fined Xandr, an advertising company owned by Microsoft, NOK 92 million (about $9.6 million) for unlawfully processing sensitive data of users of the dating app Grindr, BleepingComputer reported on October 12. According to the regulator, it is the largest fine it has ever issued, and it targets the way personal data, including information revealing sexual orientation, was shared with advertisers through real-time bidding auctions.

What happened

According to BleepingComputer, Xandr managed real-time advertising auctions inside Grindr between July 2018 and April 2020. During those auctions, Xandr acted as an intermediary that passed profiling information about Grindr users to advertisers, who then bid for the right to show them ads. Datatilsynet said this setup could expose users' data to thousands of companies.

The regulator said thousands of users in Norway were affected, and that sensitive data belonging to users in Norway and other countries was exposed. Users were not aware of the sharing and never gave explicit consent, according to the decision as reported by BleepingComputer.

Datatilsynet Director General Line Coll said the fine was set high because the breaches the authority identified were "very serious."

Legal findings

Datatilsynet concluded that Xandr was a joint controller with Grindr at the time, which made it responsible for how the data was used. As such, Xandr should have required and obtained explicit consent from users before processing data of this kind, the regulator said. Instead, Xandr assumed Grindr had obtained valid consent without verifying it. Coll said Xandr did nothing to ensure it had a legal basis for its own processing.

The case originates from a complaint filed in January 2020 by Austrian privacy nonprofit noyb together with the Norwegian Consumer Council (Forbrukerrådet). Noyb welcomed the decision, calling it a major blow to the online adtech industry, BleepingComputer reported.

Microsoft's response

Xandr now operates as Microsoft Advertising. Microsoft told BleepingComputer that the investigation focused on conduct that predates its acquisition of Xandr and that legal frameworks and their enforcement have changed since then. The company said it is reviewing the decision and assessing its options. Xandr was given three weeks to appeal; the report did not say whether an appeal had been filed.

Why it matters

The decision underscores that companies in the advertising supply chain cannot rely on a partner's assurances about consent when handling special-category data such as sexual orientation. Organizations that receive or broker personal data through real-time bidding should document their own legal basis, verify the consent obtained by publishers, and minimize the profiling attributes passed to third parties.