Norway’s privacy regulator has fined Microsoft-owned advertising company Xandr NOK 92 million, approximately $9.6 million, over unlawful processing and sharing of Grindr user data. The Xandr GDPR fine is the largest penalty Norway’s Data Protection Authority has issued.
The regulator, Datatilsynet, said the violations affected thousands of Norwegian users. Its findings concern advertising activity between July 2018 and April 2020, before Microsoft acquired Xandr.
Advertising Auctions Exposed Sensitive Information
During the period under investigation, Xandr managed real-time advertising auctions within Grindr, a location-based dating app primarily serving LGBTQ+ users.
In these auctions, advertisers received profiling information before bidding to display an advertisement. Xandr acted as an intermediary between the app and participating advertising companies.
According to Datatilsynet, the process potentially exposed personal information to thousands of businesses. That information included sensitive data concerning users’ sexual orientation.
The regulator found that this sharing occurred without the explicit consent necessary for the processing.
Xandr Failed to Verify User Consent
Datatilsynet determined that Xandr acted as a joint controller with Grindr. This meant the advertising company shared responsibility for how the personal data was used.
However, Xandr relied on an assumption that Grindr had collected valid consent. It did not verify that assumption or establish a lawful basis for its own processing, the authority said.
Consequently, the regulator concluded that Xandr had failed to meet its responsibilities when handling sensitive information.
Datatilsynet attributed the size of the penalty to the seriousness of the violations and their impact on thousands of users.
Privacy Groups Welcome Xandr GDPR Fine
The decision follows a complaint that privacy organization noyb and the Norwegian Consumer Council filed in January 2020.
Both organizations challenged the handling of Grindr users’ information within the advertising ecosystem. Following the ruling, noyb welcomed the penalty as a significant step toward holding advertising technology companies accountable.
The group also criticized practices that allow sensitive information to circulate between apps, websites and advertising platforms without valid consent.
The regulator’s findings highlight a central issue in the case: an advertising intermediary cannot simply assume another company has obtained the permissions it needs.
Microsoft Says Conduct Predates Acquisition
Xandr now operates as Microsoft Advertising. However, Microsoft emphasized that the investigation concerned conduct from before its acquisition of the business.
The company also said legal frameworks, interpretations and enforcement practices have changed since the period covered by the investigation.
Microsoft is reviewing the decision and assessing its options. Meanwhile, Xandr has three weeks to appeal the Norwegian regulator’s ruling.
0 responses to “Xandr GDPR Fine Reaches $9.6 Million Over Grindr Data Sharing”