Xandr fined $9.6 million for sharing Grindr user data without valid consent
Norway's privacy regulator penalized the ad tech firm for processing sensitive sexual orientation data in real-time auctions without proper legal basis.
Key points
- Xandr was fined 92 million Norwegian kroner for unlawfully sharing Grindr user data.
- The regulator ruled that simply being a Grindr user reveals sexual orientation, a sensitive data category.
- Xandr failed to independently verify that Grindr had obtained valid, explicit consent from users.
Norway’s Datatilsynet has imposed a fine of 92 million Norwegian kroner, approximately $9.6 million, on advertising technology company Xandr. The penalty addresses the unlawful processing and sharing of sensitive information related to Grindr users during real-time advertising auctions conducted between July 2018 and April 2020.
The regulator determined that Xandr circulated data capable of revealing users’ sexual orientation to thousands of potential advertisers. This sensitive information was transmitted through automated bidding systems without a valid legal basis. Crucially, users did not need to explicitly state their sexual orientation in their profiles; the regulator noted that mere identification as a Grindr user was sufficient to infer this sensitive characteristic.
Legal obligations and consent failures
Datatilsynet found that Xandr relied solely on Grindr’s claims regarding user consent. As a joint controller for the data processing, Xandr had independent obligations to verify that explicit consent was actually obtained. The regulator emphasized that assuming the app had secured necessary permissions was insufficient. Xandr failed to perform its own due diligence.
Privacy advocacy group noyb filed the complaint in cooperation with the Norwegian Consumer Council. The group argued that such advertising systems use tracking identifiers to build detailed profiles of individuals’ interests, habits, and behaviors. The case highlights how data sharing can occur within legitimate business operations rather than through malicious hacking.
Corporate ownership and global scope
Although the enforcement action originated in Norway, the data-sharing practices were not limited to Norwegian residents. BleepingComputer reports that information about Grindr users in other countries was also exposed through the advertising system. Consequently, users in the United States and elsewhere should not assume their data remained private simply because the fine was issued by a Norwegian authority.
Xandr is now a subsidiary of Microsoft, which completed its acquisition of the company from AT&T on June 6, 2022. This purchase occurred more than two years after the period covered by the fine. Microsoft told BleepingComputer that it is reviewing the regulatory decision and assessing its options. The misconduct predates Microsoft’s ownership of the entity.
What should you do?
Users can reduce exposure by limiting the amount of additional information disclosed to dating applications. Providing only the data necessary to use the service helps minimize the profile available for potential sharing. Leaving optional profile fields blank prevents unnecessary personal details from entering advertising ecosystems.
Avoid publishing workplace locations, home addresses, or regular schedules that could make individuals easy to locate. Linking social media accounts often reveals more identity information than intended, so users should think carefully before connecting these services. These precautions do not guarantee privacy, but they reduce the volume of data available to third parties.
What can you do to protect yourself?
Review the privacy settings of dating and social applications to limit data sharing with third-party advertisers where possible.
Limit the amount of personal information included in profiles, such as workplace or specific location details, to reduce exposure.
Avoid using dating applications on company-issued devices to prevent potential conflicts with corporate security policies.
Monitor for unusual activity or unauthorized access attempts, as sensitive data leaks can sometimes lead to targeted social engineering attacks.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
Frequently asked questions
Why was Xandr fined for sharing Grindr user data?
Xandr was fined for unlawfully processing and sharing sensitive data, including information indicating sexual orientation, without verifying that valid consent had been obtained from users.
Did the fine only affect Norwegian users?
No, while the fine was issued by Norway’s regulator, BleepingComputer reports that data from Grindr users in other countries was also exposed through the advertising system.
Was Microsoft responsible for the data sharing?
No, Microsoft acquired Xandr in June 2022, more than two years after the period covered by the fine, which occurred between 2018 and 2020.
