The Norwegian Data Protection Authority (DPA) has imposed a record fine of €8.6 million ($9.62 million) on Xandr, a Microsoft-owned advertising unit, for unlawfully sharing sensitive data of Grindr users without their consent. This penalty, the largest ever issued by the DPA, stems from violations that occurred between July 2018 and April 2020, highlighting significant concerns regarding data privacy in the advertising sector.
The DPA’s investigation revealed that Xandr acted as an intermediary, relaying personal data—including information that could disclose users’ sexual orientation—to numerous advertisers. The authority emphasized that Xandr was a joint controller with Grindr, meaning it bore responsibility for ensuring that users had provided explicit consent for their data to be processed. Instead of securing this consent, Xandr reportedly shifted the blame to Grindr, claiming it assumed the dating app had obtained the necessary permissions.
This case traces back to a complaint filed in 2020 by Norway’s consumer council and the Austrian privacy advocacy group None of Your Business (noyb), which accused Xandr of sharing users’ personal data for commercial purposes without proper consent. The DPA noted that thousands of users in Norway were affected by this practice, which involved real-time bidding where personal data was relayed to potentially thousands of advertisers, allowing them to bid for targeted ads without users’ knowledge.
The fine was calculated based on Xandr’s total annual turnover during the infringement period, which predates Microsoft’s acquisition of the company in December 2021. Xandr has three weeks to appeal the decision. In response, noyb described the fine as a significant setback for the online advertising industry, asserting that companies like Xandr must be held accountable for their practices.
Microsoft has stated that it is reviewing the DPA’s decision and considering its options. This ruling follows a recent settlement in the U.K. where Grindr agreed to pay £26 million ($35.1 million) over allegations of sharing users’ personal information, including sensitive health data, with third parties.
The DPA’s actions reflect a growing trend among regulators to enforce stricter data protection measures, particularly in the context of digital advertising, where user consent is often inadequately addressed. As the landscape of data privacy continues to evolve, companies operating in this space may face increased scrutiny and regulatory challenges.
For further details, see the report from The Hacker News.
For more insights on global cybersecurity developments, visit our Global cybersecurity coverage.
