Xandr Faces Record Fine For Unlawful Grindr Data Sharing

Norway’s Data Protection Authority has fined Microsoft-owned advertising firm Xandr $9.6 million for unlawfully processing sensitive data belonging to Grindr users. This is the largest penalty ever issued by the Norwegian regulator, according to BleepingComputer.

What happened

Datatilsynet determined that Xandr managed real-time advertising auctions inside Grindr between July 2018 and April 2020. These auctions exposed users’ data, including sensitive sexual orientation information, to thousands of companies. Advertisers bid for ad placements after receiving profiling information from Xandr, which acted as the intermediary in the process.

As a joint controller with Grindr, Xandr was responsible for how the data was used. The authority found that Xandr assumed Grindr had obtained valid consent but did not take any action to verify this claim. Consequently, sensitive information about users in Norway and other countries was shared with advertisers without explicit consent.

Line Coll, Director General of Datatilsynet, stated that the high fine reflected the seriousness of the breaches. Thousands of users in Norway were subjected to unlawful sharing of their sensitive data. Xandr omitted to verify consents and failed to ensure a legal basis for its own processing activities.

Why it matters

The decision marks the largest fine issued by Norway’s data protection authority to date. Privacy rights group Noyb, which filed the original complaint in January 2020, called the ruling a major blow to the online adtech industry. The Austrian nonprofit argued that the penalty curbs bad practices in commercial surveillance and unrestricted data exchange.

Noyb stated that the fine holds companies like Xandr accountable for shady practices. The ruling targets the covert exchange of sensitive user data between apps, platforms, and operating systems. It signals increased scrutiny for large players in the online advertising sector who rely on third-party data handling.

Next steps

• Monitor regulatory communications from Datatilsynet regarding compliance requirements.
• Review joint controller agreements to ensure explicit consent mechanisms are verified.
• Audit real-time bidding processes for potential exposure of sensitive user attributes.
• Update data processing records to reflect legal bases for all advertising activities.

What to do and how to stay safe: Xandr

• Review privacy settings on dating and location-based applications to limit data sharing.
• Check consent management platforms to ensure explicit opt-in for sensitive data processing.
• Monitor vendor disclosures for changes in data handling practices or joint controller status.
• Report suspected unlawful data processing to your local data protection authority.

Step-by-step guide: Wifi router security: Stop hidden admin access from leaking data

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much is the fine imposed on Xandr?

The fine is NOK 92 million, which equates to approximately $9.6 million.

What type of data was unlawfully shared?

Sensitive data including users’ sexual orientation was exposed to thousands of advertisers.

Did Xandr verify user consent before processing data?

No, Xandr assumed Grindr had obtained valid consent but did not verify it.