Norway Fines Microsoft-Owned Xandr $9.6 Million Over Grindr User Data Sharing
Summary
Norway fined Microsoft-owned Xandr $9.6 million for processing and sharing sensitive Grindr user data through ad auctions without verifying that users had given valid consent.
Key points
- Norway’s Data Protection Authority fined Xandr NOK 92 million, describing it as the largest fine the agency has issued.
- From July 2018 to April 2020, Xandr managed real-time ad auctions involving Grindr users’ profiling information.
- The authority said the auctions potentially exposed sensitive information, including sexual orientation, to thousands of companies.
- Xandr was responsible for its processing as a joint controller but assumed Grindr had obtained valid consent and did not verify it, according to the authority.
- The case originated with a 2020 complaint by privacy group Noyb and the Norwegian Consumer Council.
- Xandr, now operating as Microsoft Advertising, has three weeks to appeal; Microsoft said it is reviewing the decision and noted the conduct predated its acquisition of Xandr.
Article Details
- Event Type
- Norway's Data Protection Authority fined Xandr for unlawfully processing and sharing Grindr users' sensitive personal data without verifying valid consent.
- Impact
- The authority said data from Grindr users in Norway and other countries, including sensitive information about sexual orientation, was exposed to thousands of advertisers. Xandr was fined NOK 92 million (reported as $9.6 million) and was given three weeks to appeal.
People
Vendors
Products
GrindrNorway fines Microsoft ad firm $9.6 million over Grindr data sharingMicrosoft AdvertisingXandr, which now operates as Microsoft Advertising, was given three weeks to appeal the decision.XandrNorway’s Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, $9.6M (NOK 92 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in the
Countries
Industries
Commercial surveillancethe decision puts a brake to the bad practices of large players in the online advertising and commercial surveillance industry, including the unrestricted and covert exchange of sensitive user data between websites,online advertisingto the organization, the decision puts a brake to the bad practices of large players in the online advertising and commercial surveillance industry, including the unrestricted and covert exchange of sensitive