Norway’s data protection authority has fined Xandr, the advertising technology company now operating as Microsoft Advertising, 92 million Norwegian kroner, about $9.6 million, for unlawfully handling data from users of the dating app Grindr. The regulator, Datatilsynet, says it is the largest penalty it has ever issued.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The decision covers a window from July 2018 to April 2020, when Xandr took part in real-time advertising auctions inside the Grindr app. The fine landed on Xandr rather than on Grindr, and it arrives more than six years after Norwegian consumer advocates first filed complaints about the practice with the same regulator. The size of the fine is equal to roughly 8.5 million euros, a figure noyb cites, which gives the case weight well beyond Norway’s borders because the underlying rules are the European Union’s data protection law, which Norway applies through the European Economic Area.
The auctions at the center of the case
According to BleepingComputer’s report on the decision, Xandr ran bidding systems in which advertisers competed to show ads to Grindr users after receiving profiling information from Xandr, which acted as the intermediary. The process potentially exposed user data, including sexual orientation, to thousands of companies, and sensitive data from Norwegian and other users was exposed without those users realizing it or giving explicit consent.
Datatilsynet concluded that Xandr was a joint controller with Grindr, meaning it shared responsibility for the legality of the processing rather than acting as a passive vendor. Under the General Data Protection Regulation, information about a person’s sexual orientation belongs to a special category that generally requires explicit consent, and the regulator found Xandr should have required and obtained it from the people whose data it handled.
What Datatilsynet said about consent
The authority’s Director General, Line Coll, put the failure in terms of verification. “Xandr omitted to verify that the consents from Grindr were valid,” she said. In practice, the regulator found that Xandr assumed Grindr had collected valid consent from its users and never checked whether that was true, and the authority treated the missing check as a breach in its own right rather than as a technicality.
Coll also explained the size of the penalty. she said the fine was so high because the breaches identified were very serious, adding that thousands of users in Norway had been subjected to unlawful sharing of their sensitive data. The full announcement, including the regulator’s own account of the reasoning, is on Datatilsynet’s news page.
Complaints that started the investigation
The case traces to January 2020, when the Norwegian Consumer Council filed three complaints with the data protection authority as part of its Out of Control project. As the council’s complaint page shows, they named Grindr together with several third-party companies, including Twitter’s MoPub, AppNexus, OpenX, AdColony and Smaato. The Austrian privacy nonprofit noyb worked on the filings alongside the council. The council later wrote to other dating-app and data-broker companies about third-party tracking, a sign of how broad its concern about the app-advertising chain was.
That earlier track has already produced one penalty. The council’s page now carries a notice that the Court of Appeal upheld a 65 million kroner fine against Grindr itself, finding that the app violated the GDPR. The new decision against Xandr covers the other side of the data flow, the company that received and processed what the app passed along, and it is notably larger than the fine the app received.
Noyb welcomed the ruling. Felix Mikolasch, a data protection lawyer at the group, said the group very much welcomed the decision in a statement that puts the fine at about 8.5 million euros. The group called the outcome a major blow to the online advertising industry and said that profiling people’s interests, habits, location and behavior requires valid consent.
Microsoft’s response and what comes next
A Microsoft spokesperson said the investigation focused on conduct that predates the company’s acquisition of Xandr, and that legal frameworks and their interpretation and enforcement have changed since then. Microsoft said it is reviewing the decision and assessing its options, and it did not say in the statement whether it would file an appeal. That response points to the likely argument if the company contests the penalty: that the conduct belongs to a period before Microsoft owned the business.
Xandr was given three weeks to appeal, so the fine is not necessarily final. The outcome matters beyond one company, because the regulator’s reasoning places a duty to verify consent on the firms that buy and process data downstream, not only on the app that collects it. Any ad-tech business receiving user data through a partner app has an interest in how an appeal, if one is filed, comes out.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
