Xandr fined record €8.6M over Grindr data sharing in Norway
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million for illegally relaying Grindr users’ sensitive data to advertisers, according to The Hacker News. The penalty is the largest the Norwegian watchdog has issued, and Xandr has three weeks to appeal.
What we know
- The DPA says the infringements occurred between July 2018 and April 2020.
- Xandr acted as an intermediary that relayed personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies, the DPA said.
- The regulator found Xandr was a joint controller with Grindr, so it was responsible for making sure users had consented. Xandr instead pointed at Grindr and said it assumed consent had been collected.
- The case traces back to 2020, when the Norwegian consumer council and privacy non-profit noyb filed a complaint.
- The fine took into account Xandr’s total annual turnover over the two-year period, which predates Microsoft’s acquisition.
- Microsoft told Reuters it is reviewing the decision and assessing its options.
Xandr was formed by AT&T after it acquired AppNexus in 2018, and was sold to Microsoft in late 2021. The brand has since been folded into Microsoft Ads.
How the data flowed
The DPA describes the core problem as Xandr’s participation in real-time bidding, where it acted on both the buyer and seller side. When a person opened Grindr, their data was in many cases passed through Xandr to a large number of parties in the advertising ecosystem, so advertisers could bid to show targeted ads, hidden from the user.
Who is affected
Thousands of users in Norway are said to have had sensitive data shared unlawfully. The data included information revealing sexual orientation. How many third parties ultimately received it, and what they did with it, has not been disclosed.
Separately, the source notes that Grindr agreed last month to pay £26 million to settle a UK lawsuit over allegations that it shared personal information, including HIV status, with third parties.
Why this matters
Analysis, not new facts: this is a privacy enforcement action rather than an intrusion, but the exposure is similar to a breach for the people involved. Once sensitive attributes are broadcast into a bidding network, they cannot be recalled. For security and privacy teams, the case shows that regulators treat ad-tech intermediaries as responsible parties, and that a partner’s assumption about consent is not a defence.
What has not been confirmed
- Whether Xandr will appeal; the deadline is three weeks.
- Microsoft’s final position, which it says is under review.
- The full list of recipients of the Grindr data.
What to do
- If you operate apps or sites that feed data into ad exchanges, map every SDK, tag and bidding partner that receives user data, and confirm what categories are sent.
- Check that special-category data (health, sexual orientation and similar) is never passed to advertising partners without valid explicit consent that you can evidence.
- Review joint-controller arrangements and contracts. Document who collects consent and verify it rather than assuming it.
- Ask your legal and privacy teams to review data-processing agreements with ad-tech vendors, including those acquired by other companies.
- Hunt for unexpected outbound requests to advertising and analytics domains from apps that handle sensitive data, using your proxy or mobile traffic logs.
- If you are a Grindr user in Norway, watch for official notices from the regulator or the company, and review the app’s privacy and ad-personalisation settings.
