Norway Fines Xandr $9.6 Million Over Sharing Grindr Users’ Sensitive Data
Summary
Norway’s privacy regulator fined Xandr about $9.6 million for sharing information that could reveal Grindr users’ sexual orientation through ad auctions without verifying valid consent.
Key points
- The regulator said Xandr processed Grindr users’ data in real-time ad auctions from July 2018 to April 2020.
- Being identified as a Grindr user could itself reveal sexual orientation, even without disclosure in a profile.
- Datatilsynet said Xandr relied on Grindr for consent without checking that it was valid, despite Xandr’s own obligations.
- The data-sharing practices affected users beyond Norway, according to the article.
- Microsoft acquired Xandr in 2022, after the period covered by the fine, and said it was reviewing the decision.
Article Details
- Event Type
- Norwegian privacy enforcement action and fine for unlawful processing and sharing of sensitive user information through advertising auctions.
- Impact
- Datatilsynet fined Xandr 92 million Norwegian kroner (approximately $9.6 million). Between July 2018 and April 2020, information indicating that people used Grindr, and therefore potentially revealing sexual orientation, could be shared with thousands of companies through ad auctions without valid consent. The article says users in Norway and other countries were affected; it was not a hacker intrusion.
Vendors
Products
Countries
NorwayNorway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about GrindrUnited StatesThis is a Norwegian enforcement action, but the data-sharing practices crossed borders. Users in the US and elsewhere shouldn’t assume their information stayed private just because the fine was issued in Norway.