● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
Norway Fines Microsoft Subsidiary Xandr $9.6 Million for Grindr Data Misuse
Key points
- Xandr, a Microsoft subsidiary, was fined $9.6 million by Norway's data protection authority.
- The fine is for allegedly misusing Grindr user data for advertising without explicit consent.
- Sensitive data, including sexual orientation, was shared with thousands of advertisers.
- This is the largest fine ever issued by the Norwegian Data Protection Authority.
- The case originated from a 2020 complaint against Xandr, prior to Microsoft's ownership.
- The fine is €8.6 million.
- The infringements occurred between July 2018 and April 2020.
- Xandr was a joint controller with Grindr.
- Xandr was formed by AT&T after its June 2018 acquisition of AppNexus.
Record Fine Issued for Data Misuse
The Norwegian Data Protection Authority (NDPA) has imposed a fine of 92 million Norwegian kroner, equivalent to approximately $9.6 million, on Xandr, an adtech subsidiary of Microsoft. This penalty is the largest ever issued by the Norwegian authority. The NDPA alleges that Xandr failed to obtain explicit consent from Grindr users before utilizing their sensitive personal data for advertising purposes.
Details of the Allegations
According to the NDPA, Xandr assumed that Grindr had already secured user approval for data sharing. However, the authority found that when a person opened Grindr, their personal data was often relayed through Xandr to potentially thousands of actors in the advertising ecosystem. This allowed advertisers to bid against each other to present targeted advertisements, a process hidden from the individual user.
The NDPA's findings indicate that between July 2018 and April 2020, Xandr managed real-time advertising auctions within Grindr. During this period, users' data, including sensitive information like sexual orientation, was potentially exposed to thousands of companies. Xandr, acting as an intermediary, provided profiling information to advertisers who then bid for the right to display ads.
Background and Responsibility
The case originated from a complaint filed in 2020 by Norway's consumer council against Xandr. At the time of the complaint, Xandr was not yet owned by Microsoft. The complaint accused Xandr of unlawfully sharing users' personal data for commercial purposes without obtaining proper consent. The NDPA stated that Xandr was a joint controller with Grindr, meaning it shared responsibility for how the data was used and should have obtained explicit consent from data subjects.
Severity of the Breach
Line Coll, Director General of Datatilsynet (the NDPA), emphasized the seriousness of the identified breaches, stating that thousands of users in Norway had been subjected to unlawful sharing of their sensitive data. Xandr has three weeks to appeal the penalty.
Updates
- The fine is €8.6 million.
- The infringements occurred between July 2018 and April 2020.
- Xandr was a joint controller with Grindr.
- Xandr was formed by AT&T after its June 2018 acquisition of AppNexus.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
The Norwegian Data Protection Authority (DPA) fined Xandr, a Microsoft advertising unit, €8.6 million for illegally relaying Grindr users' sensitive data, including sexual orientation, to advertisers. This is the largest fine issued by the DPA, highlighting the serious nature of data privacy breaches involving sensitive personal information in programmatic advertising.
Norway's Data Protection Authority fined Microsoft-owned Xandr $9.6 million for unlawfully processing and sharing sensitive data of Grindr users. Xandr, an advertising firm, exposed user data, including sexual orientation, to thousands of companies through real-time ad auctions without explicit consent, marking the largest fine ever issued by the authority.
Norway's data protection authority fined Microsoft subsidiary Xandr $9.6 million for allegedly using Grindr user data for advertising without explicit consent. This marks the highest fine issued by the Norwegian authority to date, stemming from a 2020 complaint regarding data sharing practices.