Key points
- Xandr paid a $9.6 million fine to Norway’s Data Protection Authority for unlawful data sharing.
- The firm failed to verify that Grindr had obtained valid consent from users before sharing their data.
- Sensitive sexual orientation data was exposed to thousands of advertisers between 2018 and 2020.
The short version
- Norway’s Data Protection Authority fined Xandr, a Microsoft-owned advertising company, $9.6 million.
- The penalty relates to the unlawful processing of sensitive data from Grindr users in Norway.
- This is the largest fine ever issued by the Norwegian regulator, according to agency officials.
The details
Norway’s Data Protection Authority, known as Datatilsynet, imposed a fine of NOK 92 million on Xandr for serious breaches of data protection laws. Line Coll, the Director General of Datatilsynet, stated that the agency issued such a high penalty because the identified breaches were very serious. According to Coll, thousands of users in Norway were subjected to the unlawful sharing of their sensitive data. This penalty represents the largest fine the authority has ever issued, marking a significant enforcement action against the Microsoft-owned advertising firm.
The investigation found that between July 2018 and April 2020, Xandr managed real-time advertising auctions within the Grindr application. These auctions allowed advertisers to bid for the right to display ads to Grindr users. In this process, Xandr acted as an intermediary and provided profiling information to the bidders. The authority’s findings indicate that this practice potentially exposed users’ data, including sensitive information regarding sexual orientation, to thousands of companies without proper legal safeguards in place during that specific time frame.
Grindr is a location-based dating app that primarily serves the LGBTQ+ community. At the time of the violations, Xandr and Grindr were considered joint controllers of the user data. This legal status meant Xandr was responsible for how the data was used and was required to obtain explicit consent from the data subjects for this processing. However, the regulator found that Xandr did not take action to verify that Grindr had obtained valid consent. Instead, the company assumed the consent was valid, failing to ensure it had a legal basis for its own processing activities.
The context
Austrian nonprofit privacy rights organization Noyb filed the original complaint in January 2020. Noyb worked together with the Norwegian Consumer Council, known as Forbrukerrådet, to bring the issue to the attention of the regulator. Both organizations applauded the Datatilsynet decision. They described the ruling as a major blow to the online adtech industry. According to Noyb, the decision puts a brake on bad practices among large players in the online advertising and commercial surveillance sectors.
Noyb stated that the fine shows companies like Xandr are eventually held accountable for their shady practices. The organization emphasized that the ruling addresses the unrestricted and covert exchange of sensitive user data. This data exchange often occurs between websites, apps, platforms, and operating systems. The statement from Noyb highlights concerns about how sensitive information is shared across the digital ecosystem without users realizing it or providing explicit consent for such broad distribution.
What to watch
The case underscores the legal risks associated with relying on third parties for data consent. Regulators expect companies to verify the validity of consent rather than assuming it exists. The exposure of sensitive data through real-time bidding mechanisms remains a focal point for privacy enforcement. Future investigations may scrutinize similar data flows in other applications and advertising platforms.
What to do and how to stay safe: Xandr
- Review the privacy settings of dating and social applications to limit data sharing with third-party advertisers.
- Check if apps provide options to opt out of personalized advertising or data profiling features.
- Monitor official communications from data protection authorities for updates on enforcement actions involving your apps.
- Use unique passwords for sensitive accounts to reduce the impact if data is exposed in future breaches.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much was the fine imposed on Xandr?
Norway’s Data Protection Authority fined Xandr $9.6 million, which is equivalent to NOK 92 million.
What specific data was unlawfully shared?
The sharing involved sensitive data belonging to Grindr users, including information about their sexual orientation.
Why was Xandr fined if Grindr collected the data?
Xandr failed to verify that Grindr had obtained valid consent from users before processing and sharing the data.
