Norway Imposes Historic Fine on Xandr for Grindr Data Violations
Norway’s Data Protection Authority (Datatilsynet) has issued a record-breaking fine of $9.6 million (NOK 92 million) against Xandr, a Microsoft-owned advertising technology company, for unlawfully processing and sharing sensitive personal data from users of the Grindr dating app. The authority stated this is the largest penalty it has ever imposed, citing the severity of the data protection breaches identified in its investigation.
"We issued such a high fine in this case because the breaches we identified were very serious,"
— Line Coll, Director General of Datatilsynet
According to the authority’s findings, between July 2018 and April 2020, Xandr managed real-time advertising auctions within the Grindr app that exposed users’ data — including sensitive sexual orientation information — to thousands of third-party advertisers. In this system, advertisers bid to display ads to Grindr users after receiving profiling data from Xandr, which served as an intermediary in the ad tech ecosystem.
Joint Controller Responsibility and Lack of Consent Verification
At the time of the alleged violations, Xandr operated as a joint data controller with Grindr, meaning it shared responsibility for how user data was processed and was legally obligated to ensure a valid legal basis — such as explicit consent — for such processing. However, Datatilsynet found that Xandr assumed Grindr had obtained proper consent from users without taking any steps to verify this assumption.
"Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing,"
— Line Coll
As a result, sensitive data from Grindr users in Norway and other countries was shared with numerous advertisers without the users’ knowledge or explicit permission, violating core principles of the General Data Protection Regulation (GDPR), which Norway incorporates into its national law.
Privacy Groups Welcome the Decision as a Turning Point
The ruling was welcomed by privacy advocacy groups, including the Austrian nonprofit Noyb (None of Your Business) and the Norwegian Consumer Council (Forbrukerrådet), which had jointly filed the original complaint in January 2020. Noyb described the fine as "a major blow to the online adtech industry" and emphasized that it signals growing accountability for companies engaged in covert data profiling and surveillance-based advertising.
"The current fine shows that companies such as Xandr are eventually held accountable for their shady practices. Profiling people’s interests, habits, location, and behavior requires valid consent — which adtech companies hardly ever obtain."
— Noyb
Microsoft’s Response and Context of Acquisition
Following the fine, BleepingComputer contacted Microsoft for comment. A spokesperson clarified that the investigation and subsequent penalty pertain to conduct that occurred before Microsoft’s acquisition of Xandr. The company noted that legal frameworks and enforcement practices have evolved since that period and stated that Microsoft is currently reviewing the decision and evaluating its options regarding appeal or further action.
Xandr now operates under the name Microsoft Advertising. The firm was granted three weeks from the date of the decision to file an appeal. The case underscores increasing regulatory scrutiny of data sharing practices in the digital advertising sector, particularly concerning sensitive information from marginalized communities.
Source: BleepingComputer