Norway Hits Microsoft Ad Firm Xandr With Record $9.6M Fine Over Grindr Data Sharing

Norway’s Data Protection Authority (Datatilsynet) has issued its largest fine ever, penalizing Microsoft-owned advertising company Xandr $9.6M (NOK 92 million) for unlawfully processing and sharing sensitive Grindr user data. An investigation revealed that between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that exposed user profiling information, including sexual orientation, to thousands of external companies. As a joint data controller, Xandr assumed Grindr had obtained valid consent for the data sharing but failed to take any action to verify the legal basis for its own processing operations. The original privacy complaint was filed in January 2020 by the Austrian nonprofit rights organization Noyb alongside the Norwegian Consumer Council. Microsoft stated that the penalized conduct predates its acquisition of Xandr and confirmed it is currently reviewing the agency's decision. "We issued such a high fine in this case because the breaches we identified were very serious. Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data." — Line Coll, Director General of Datatilsynet