Xandr fined €8.6 million over Grindr data sharing in Norway
Norway's data regulator says Xandr passed sensitive Grindr user data through real-time bidding to potentially thousands of companies.
Microsoft-owned advertising business Xandr has been fined €8.6 million by Norway's data protection authority for relaying Grindr users' personal data to potentially thousands of companies. The regulator said the information included data revealing sexual orientation and was passed through real-time bidding without a lawful basis.1
What the Norwegian regulator found
The Norwegian Data Protection Authority, known as Datatilsynet, said Xandr acted as a joint controller with Grindr during the period covered by the case, from July 2018 to April 2020. That meant Xandr could not simply rely on Grindr to have obtained the consent required for its own processing.1
According to the regulator, when a person opened Grindr, their data could be relayed through Xandr to potentially thousands of actors in the advertising ecosystem. Advertisers could then bid to show targeted adverts, with the process hidden from the individual user.1
The authority described the infringement as very serious and said the penalty is its largest ever. Xandr has three weeks to appeal the decision.2
Why real-time bidding matters
Real-time bidding is the automated auction system used to place adverts as a page or app loads. It can involve a large number of companies receiving signals about a user before an advert appears. In this case, the regulator said the data involved was especially sensitive because it could reveal sexual orientation.1
The case began with a complaint from Norway's Consumer Council and privacy organisation noyb. Noyb called the decision a major blow for the online advertising and commercial-surveillance industry.2 Reuters reported that Microsoft is reviewing the decision and assessing its options.3
The penalty also arrives amid wider scrutiny of Grindr's handling of personal information. The Hacker News notes that Grindr agreed to pay £26 million in September to settle a UK lawsuit over allegations that it shared users' information, including HIV status, with third parties.2
Our opinion
This case is a useful reminder that privacy risk is not limited to a company being hacked. Sensitive information can also spread through ordinary advertising infrastructure when too many parties are allowed to treat consent as somebody else's responsibility.
The most important detail is not the headline figure but the chain of custody: a person opened a dating app, their data entered an automated bidding system and potentially thousands of companies could receive it. That is a poor bargain for users who were never given a meaningful view of where their information travelled.
The regulator's decision is not the end of the case while an appeal remains possible, but it does give advertisers and platforms a clear warning. Passing responsibility down the chain is not a substitute for having a lawful basis to process sensitive data. Photo by Ann H on Pexels illustrates the wider privacy theme without depicting any of the named companies.