Norway’s Data Protection Authority (Datatilsynet) has issued a $9.6 million (NOK 92 million) fine against Xandr, the Microsoft-owned advertising company, for unlawfully processing and sharing sensitive data belonging to Grindr users. The regulator describes it as the largest fine it has ever handed down.

“We issued such a high fine in this case because the breaches we identified were very serious,” said Line Coll, Director General of Datatilsynet. “Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.”

Real-time bidding exposed sensitive data

Between July 2018 and April 2020, Xandr ran real-time advertising auctions inside Grindr, a location-based dating app that primarily serves the LGBTQ+ community. In these auctions, advertisers bid for the right to show ads to users after receiving profiling data from Xandr, which acted as intermediary. The information shared reportedly included sensitive sexual orientation data, exposed to thousands of companies.

At the time, Xandr was a joint data controller alongside Grindr, meaning it shared responsibility for ensuring a valid legal basis existed for processing the data. Datatilsynet found that Xandr simply assumed Grindr had obtained proper user consent and never verified it.

“Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing,” Coll said. As a result, sensitive data on Grindr users from Norway and other countries was shared with advertisers without users’ knowledge or explicit consent.

Complaint dates back to 2020

The case originated from a January 2020 complaint filed by Austrian privacy nonprofit Noyb alongside the Norwegian Consumer Council (Forbrukerrådet). Both organizations welcomed the decision, with Noyb calling it “a major blow to the online adtech industry” and saying it should curb the unrestricted, covert exchange of sensitive user data across apps, platforms, and operating systems.

“The current fine shows that companies such as Xandr are eventually held accountable for their shady practices,” Noyb said, adding that profiling based on interests, habits, location, and behavior requires valid consent that adtech firms rarely obtain.

Microsoft response

Xandr, now operating as Microsoft Advertising, has three weeks to appeal. A Microsoft spokesperson told BleepingComputer the investigation and outcome “focused on conduct that predates Microsoft’s acquisition of Xandr,” noting that legal frameworks and enforcement practices have since changed. Microsoft said it is reviewing the decision and assessing its options.