The Norwegian Data Protection Authority (Datatilsynet) has fined Xandr, an advertising company owned by Microsoft, $9.6 million (NOK 92 million) for unlawfully processing and sharing sensitive data of Grindr users in the country.
The data protection authority said this was the largest fine it had ever imposed.
“We imposed such a large fine in this case because the violations we identified were very serious,” said Line Coll, general director of Datatilsynet.
“Thousands of users in Norway have fallen victim to unlawful sharing of their sensitive data.”
According to the agency’s findings, between July 2018 and April 2020, Xandr managed real-time advertising auctions within Grindr that may have shared user data, including sensitive sexual orientation information, with thousands of companies.
In these auctions, advertisers bid for the right to show an ad to a Grindr user after receiving profile information from Xandr, which acted as an intermediary.
At that point, Xandr was a joint controller with Grindr, which meant that it was responsible for the use of the data and had to seek and obtain the express consent of data subjects for this processing.
Grindr is a location-based dating app that primarily serves the LGBTQ+ community.
According to the Norwegian Data Protection Authority, Xandr assumed that Grindr had obtained valid consent, but took no steps to verify it.
“Xandr failed to verify whether Grindr’s consents were valid and did nothing to ensure that they had a legal basis for their own processing.” Coll explained.
As a result, sensitive information about Grindr users from Norway and other countries was exposed to thousands of advertisers without the users realizing it or ever providing their explicit consent.
The Austrian non-profit data protection organization Noyb, which filed the original complaint in January 2020 together with the Norwegian Consumer Council (The Consumer Council), welcomed Datatilsynet’s decision, calling it “a major blow to the online adtech industry.”
According to the organization, the decision curbs bad practices by major players in the online advertising and commercial surveillance industries, including the unrestricted and covert sharing of sensitive user data between websites, apps, platforms and operating systems.
“The current fine shows that companies like Xandr will ultimately be held accountable for their shady practices.” said Noyb.
“Profiling people’s interests, habits, locations and behaviors requires valid consent – which adtech companies rarely obtain.”
Xandr, which now operates as Microsoft Advertising, had three weeks to appeal the decision.
BleepingComputer contacted Microsoft for comment on the Norwegian agency’s decision, and a spokesperson emphasized that the investigation and outcome “focused on conduct that occurred prior to Microsoft’s acquisition of Xandr.”
Since then, the legal framework and the way it is interpreted and enforced have changed, the spokesperson said, adding that Microsoft is “reviewing the decision and considering our options.”
