Norway’s Data Protection Authority, Datatilsynet, has issued a $9.6 million fine to Microsoft-owned advertising company Xandr for unlawfully processing and sharing sensitive data belonging to Grindr users between July 2018 and April 2020. The NOK 92 million penalty stands as the largest fine ever handed down by the Norwegian privacy regulator.
Thousands of users in Norway had their data shared without proper consent. The breach exposed sensitive information, including sexual orientation, during real-time advertising auctions managed by Xandr as an intermediary.
Real-Time Ad Auctions Exposed Sensitive User Profiles
The regulatory findings detail how Xandr operated as a joint controller with Grindr during the specified period. Advertisers participating in real-time bidding submit offers to show advertisements to a Grindr user after Xandr supplies them with profiling data. Xandr facilitated these transactions while failing to check whether valid, explicit consent had been secured from the individual users.
Thousands of companies gained access to this information. The architecture of modern programmatic advertising allowed user data to circulate to thousands of advertisers.
“We issued such a high fine in this case because the breaches we identified were very serious. Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data,” said Line Coll, Director General of Datatilsynet.
Xandr assumed Grindr had handled compliance. Datatilsynet established that the ad firm did not take any action to verify that legal bases existed for its own data processing activities. Users remained completely unaware that their personal attributes were entering commercial auction blocks.
Privacy Advocates Applaud the Record Penalty
The enforcement action follows a formal complaint filed in January 2020 by Austrian privacy rights organization Noyb alongside the Norwegian Consumer Council, known as Forbrukerrådet. Both groups welcomed the decision as a major blow to the online adtech industry.
“The current fine shows that companies such as Xandr are eventually held accountable for their shady practices. Profiling people’s interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain,” Noyb stated.
According to the privacy groups, the ruling acts to restrain illicit behaviors by major corporations within the commercial surveillance and online advertising sector, such as the hidden and unhindered sharing of private user information across platforms, applications, websites, and operating systems.
Microsoft Responds to Legacy Conduct
Xandr now operates as Microsoft Advertising. Following the penalty announcement, a Microsoft spokesperson emphasized that the investigation and the outcome “focused on conduct that predates Microsoft’s acquisition of Xandr.”
The company noted that legal frameworks and the way they are interpreted and enforced have changed since then. Microsoft confirmed it is currently reviewing Datatilsynet’s decision and assessing available options.
Xandr was given three weeks to appeal the decision.
