- Norway’s Data Protection Authority fined Microsoft’s Xandr €8.6 million ($9.62 million) for illegally sharing Grindr users’ sensitive data, including sexual orientation, with advertisers via real-time bidding.
- The watchdog deemed Xandr a joint controller with Grindr, making it responsible for obtaining user consent — which it failed to secure, instead assuming Grindr had done so.
- The fine, the largest ever issued by the Norwegian DPA, covers infringements between July 2018 and April 2020, and Xandr has three weeks to appeal the decision.
Norway’s Data Protection Authority has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users’ sensitive data, including sexual orientation, to advertisers between July 2018 and April 2020. The administrative penalty is the largest issued by the watchdog, which argued the case merited a high fine because of the “very serious” nature of the breach, according to a statement.
The investigation found that Xandr acted as a joint controller with Grindr, making it responsible for obtaining users’ consent before processing their data. “Instead of ensuring they had the legal basis for their own processing of the data, Xandr pointed fingers at Grindr, stating it assumed the online dating app had collected users’ consent to do so,” the authority added.
The case originated in 2020 when Norway’s consumer council, alongside Austrian privacy non-profit None of Your Business (noyb), filed a complaint accusing Xandr of unlawfully sharing personal data for commercial purposes without explicit consent. The watchdog explained that when a person opened Grindr, their data was relayed through Xandr to potentially thousands of actors in the advertising ecosystem via real-time bidding, enabling advertisers to bid against each other for targeted ad placement — entirely hidden from the user.
noyb described the fine as a “major blow for the online advertising and commercial surveillance industry,” adding that “companies such as Xandr are eventually held accountable for their shady practices,” per a statement. Microsoft told Reuters it is reviewing the decision and assessing its options.
Meanwhile, last month Grindr opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users’ personal information, including HIV status, with third parties. Separately, a Texas federal judge granted final approval of a $177 million AT&T settlement for consumers whose data was exposed in two 2024 breaches — one involving Social Security numbers affecting about 73 million account holders, and another compromising call and text records for nearly all cellular customers from a third-party cloud platform, as reported at the time.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
