Norway’s data protection regulator has fined Microsoft-owned advertising company Xandr NOK 92 million, approximately €8.6 million, for unlawfully processing and sharing Grindr users’ personal data, including information revealing their sexual orientation.
The penalty is the largest issued by the Norwegian Data Protection Authority to date and concerns violations between July 2018 and April 2020, before Xandr became part of Microsoft.
The investigation followed a 2020 complaint by the Norwegian Consumer Council, working with privacy advocacy group noyb. The organizations challenged how Grindr and advertising technology companies handled users’ data after researching the flow of personal information from smartphone apps to advertising partners.
Xandr, known as AppNexus at the time of the complaint, operates advertising technology that connects buyers and sellers of digital advertising space. Grindr is a location-based dating app aimed at gay, bisexual, transgender, and queer people, making information about its users particularly sensitive.
Data distributed through advertising auctions
The regulator found that Xandr participated on both sides of real-time bidding, an automated process in which advertisers compete to display targeted ads. When users opened Grindr, Xandr often relayed their personal information to potentially thousands of companies in the advertising ecosystem.
These auctions happen in fractions of a second and involve sharing user information so advertisers can decide which impressions to bid on. The authority said this activity took place out of users’ sight, leaving them with little visibility into where their information went or how it could subsequently be used.
According to the regulator, being identified as a Grindr user itself indicates sexual orientation and therefore warrants special protection. The authority also pointed to a Borgarting Court of Appeal ruling supporting that position in the separate case involving Grindr’s NOK 65 million fine, issued in 2021.
Xandr argued that it believed Grindr had obtained users’ consent. However, the authority concluded that explicit consent was required and that Xandr had neither verified the validity of Grindr’s consents nor established a lawful basis for its own processing.
The decision identified Xandr as a joint controller with Grindr, holding it responsible for ensuring and documenting compliance with data protection requirements.
Responsibility cannot be outsourced
Director General Line Coll said companies cannot shift their data protection obligations onto other participants in the advertising chain. She warned that sensitive information, once distributed, can be combined with other data to build detailed profiles of individuals.
In setting the penalty, the authority considered Xandr’s position in the advertising sector, its direct financial benefit from the unlawful sharing, and the almost two-year duration of the infringements.
The calculation used Xandr’s own annual turnover rather than Microsoft’s because the violations occurred before Microsoft owned the company.
Noyb welcomed the outcome, with data protection lawyer Felix Mikolasch describing it as a valuable precedent for advertising companies that operate in the background and rarely face accountability. Norwegian Consumer Council digital policy director Finn Myrstad said it sends a strong signal to businesses built around tracking and profiling consumers.
Xandr has three weeks from receiving the decision to appeal.
Leave a Reply