Norway’s Data Protection Authority (Datatilsynet) has fined the advertising company Xandr 92 million Norwegian kroner (about $9.6 million, or €8.6 million), the largest fine the authority has issued. It found that Xandr unlawfully processed and shared sensitive personal data belonging to users of the Grindr dating app in Norway.
According to the authority, Xandr, which now operates as Microsoft Advertising, ran real-time advertising auctions inside Grindr between July 2018 and April 2020. Advertisers bid for the right to show an ad after receiving profiling information relayed by Xandr, and that information included data revealing users’ sexual orientation, exposing it to potentially thousands of companies. Xandr was a joint controller with Grindr and said it assumed Grindr had collected valid consent; the regulator rejected that, saying companies cannot simply blame one another and that Xandr did nothing to verify the consents. The case began with a January 2020 complaint from the Norwegian Consumer Council and the privacy group noyb.
Microsoft told BleepingComputer the decision concerns conduct that predates its acquisition of Xandr, that laws and their enforcement have changed since, and that it is reviewing the decision and assessing its options. Xandr has three weeks to appeal. We covered a separate Grindr data-sharing settlement last month in Grindr HIV data sharing settlement; this is a distinct enforcement action against the ad intermediary.