Norway fines Microsoft-owned Xandr $9.6M for unlawful Grindr data sharing
The Norwegian data authority issued its largest-ever penalty against the ad firm for exposing sensitive user information to thousands of advertisers.
Key points
- Norway's Datatilsynet fined Microsoft-owned Xandr $9.6 million for unlawful processing of Grindr user data.
- The penalty covers violations occurring between July 2018 and April 2020 involving sensitive sexual orientation data.
- Xandr failed to verify that Grindr had obtained valid consent from users before sharing their information.
Norway’s Data Protection Authority, known as Datatilsynet, has imposed a fine of NOK 92 million on Xandr, an advertising company owned by Microsoft. The regulator determined that the firm unlawfully processed and shared sensitive personal data belonging to users of the dating application Grindr within Norway.
According to BleepingComputer, this penalty represents the largest fine ever issued by the Norwegian authority. Line Coll, the Director General of Datatilsynet, stated that the breaches identified were very serious. She noted that thousands of users in Norway were subjected to the unlawful sharing of their sensitive data without proper justification or oversight.
Regulatory findings and timeline
The authority’s investigation found that between July 2018 and April 2020, Xandr managed real-time advertising auctions inside the Grindr application. During these auctions, Xandr acted as an intermediary, providing profiling information to advertisers who bid for the right to display ads to specific users. This process potentially exposed users’ data, including sensitive information regarding sexual orientation, to thousands of companies.
At the time of these activities, Xandr was considered a joint controller with Grindr. This legal status meant Xandr was responsible for how the data was used and was required to obtain explicit consent from the data subjects for such processing. However, the regulator found that Xandr assumed Grindr had obtained valid consent but did not take any action to verify this claim.
Impact on users and industry
Grindr is a location-based dating app that primarily serves the LGBTQ+ community. Because Xandr did not ensure it had a legal basis for its own processing, sensitive information about users from Norway and other countries was exposed to thousands of advertisers. Many of these users were unaware that their data was being shared, nor did they provide the explicit consent required for such exposure.
Austrian privacy rights organization Noyb, which filed the original complaint in January 2020 alongside the Norwegian Consumer Council, applauded the decision. Noyb described the ruling as a major blow to the online adtech industry. The organization stated that the decision puts a brake on the bad practices of large players in commercial surveillance, specifically the unrestricted and covert exchange of sensitive user data between platforms.
What should you do?
That suggests organizations relying on third-party advertising technologies must rigorously verify consent mechanisms. Security professionals should review data-sharing agreements to ensure joint controllers are held accountable for compliance. Users should remain aware that their data may be shared in ways they do not explicitly authorize, particularly in apps handling sensitive information.
What to do and how to stay safe: Xandr
- Review privacy settings on dating and social applications to limit the amount of personal data shared with third parties.
- Monitor application permissions to ensure that only necessary data is accessed by apps installed on your device.
- Read privacy policies to understand how your data is used in advertising auctions and by joint controllers.
- Stay informed about data protection regulations in your region to understand your rights regarding sensitive personal information.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much is the fine imposed on Xandr?
The fine is NOK 92 million, which is equivalent to approximately $9.6 million.
What specific data was unlawfully shared?
Sensitive data belonging to Grindr users, including information about their sexual orientation, was shared with thousands of advertisers.
Did Xandr verify user consent before sharing data?
No, Xandr assumed Grindr had obtained valid consent but did not take any action to verify it or ensure a legal basis for processing.
