Norwegian Authority Fines Microsoft Xandr €8.5 Million for GDPR Violations

The Norwegian Data Protection Authority has imposed a €8.5 million fine on Microsoft’s Xandr unit. The regulator determined that the online advertising company violated the General Data Protection Regulation by processing personal data without a valid legal basis.

The penalty specifically addresses Xandr’s handling of sensitive information, including data revealing users’ sexual orientation. This data was collected through the dating application Grindr. The authority concluded that Xandr lacked the necessary consent or other legal grounds to process such highly personal details for advertising purposes.

Regulatory Background and Complaint

The enforcement action follows a complaint filed in 2020 by noyb, in cooperation with the Norwegian Consumer Council. The advocacy groups targeted Xandr alongside other adtech companies that received personal data via Grindr. The complaint highlighted how smartphone applications often transmit user habits, interests, and behavior to numerous third-party entities.

According to noyb, the filing was part of a broader effort to challenge the practices of the online advertising industry. The organization filed three separate GDPR complaints in 2020 against Grindr and several partners that processed the data. These complaints sought to address the lack of transparency and accountability in how user profiles are built and shared.

Impact on the Adtech Industry

The decision marks a significant development for the commercial surveillance sector. Felix Mikolasch, a data protection lawyer at noyb, stated that the ruling sets a valuable precedent for holding background operators accountable. He noted that adtech companies rarely face consequences for their data processing practices.

The Norwegian Consumer Council had previously reported that apps send personal data to thousands of advertising partners. These entities use tracking IDs to create comprehensive user profiles. The fine demonstrates that regulators are willing to penalize companies that accumulate and share data without obtaining valid consent from individuals.

What should you do?

Security and privacy professionals should monitor regulatory decisions in Europe for precedents affecting global compliance strategies. Organizations involved in data processing should review their legal bases for handling sensitive categories of information. Companies should ensure that consent mechanisms are explicit and documented, particularly when sharing data with third-party advertising partners.

What to do and how to stay safe: Microsoft

• Audit data sharing agreements with advertising technology partners to ensure clear legal bases for processing.
• Review consent mechanisms to verify they explicitly cover the collection and sharing of sensitive personal data.
• Monitor regulatory filings and enforcement actions to anticipate shifts in compliance requirements for data brokers.
• Implement strict data minimization practices to limit the amount of sensitive information passed to third parties.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why was Xandr fined by the Norwegian Data Protection Authority?

Xandr was fined for processing personal data, including sensitive information on sexual orientation from Grindr users, without a valid legal basis under the GDPR.

Who filed the original complaint against Xandr?

The complaint was filed in 2020 by noyb in cooperation with the Norwegian Consumer Council.

How much is the fine imposed on Xandr?

The Norwegian Data Protection Authority ordered Xandr to pay a fine of €8.5 million.