Norway Fines Xandr €8.6 Million for Sharing Grindr Users’ Sensitive Data
Summary
Norway’s data protection authority fined Xandr €8.6 million for relaying Grindr users’ data, including information revealing sexual orientation, to advertisers without ensuring it had users’ consent.
Key points
- The Norwegian Data Protection Authority said the violations occurred from July 2018 to April 2020 and imposed its largest-ever penalty.
- Xandr relayed Grindr users’ personal data to potentially thousands of companies through real-time bidding.
- The authority found Xandr was a joint controller with Grindr and responsible for obtaining consent before processing the data.
- Xandr has three weeks to appeal; Microsoft said it is reviewing the decision and assessing its options.
- The fine followed a 2020 complaint by Norway’s consumer council and privacy group noyb.
Article Details
- Event Type
- Privacy enforcement action and regulatory fine for unlawful sharing of sensitive personal data
- Impact
- Xandr was fined €8.6 million for relaying Grindr users’ personal data, including data revealing sexual orientation, to potentially thousands of advertising companies without ensuring a legal basis for processing. The authority said thousands of users in Norway were affected.
Vendors
AT&TXandr was formed by AT&T following its June 2018 acquisition of AppNexus. The name is a reference to Alexander Graham Bell, who founded AT&T in 1885. It was subsequently sold to Microsoft in late December 2021,MicrosoftThe Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers.Snowflakethreat actors illegally downloading AT&T customer data from a third-party cloud platform hosted by Snowflake. The American company said that calls and text message records that occurred between May 1 and October
Products
GrindrThe Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers.Microsoft Adsto Microsoft in late December 2021, following which the brand was retired and consolidated under the Microsoft Ads umbrella in June 2023.XandrThe Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers.