Norway Record Fine: Microsoft Xandr Penalised €8.6M for Grindr Data Sharing

Microsoft-owned ad firm Xandr hit with Norway's record €8.6m privacy fine for secretly sharing Grindr users' sexual orientation data with advertisers.

A Microsoft-owned advertising company has been hit with Norway’s biggest-ever privacy fine for secretly sharing Grindr users’ sexual orientation data with thousands of advertisers without proper consent.

The Norwegian Data Protection Authority (Datatilsynet) has slapped Xandr with a crushing €8.6 million ($9.6 million) penalty — equivalent to 92 million Norwegian kroner, for what regulators called «extremely serious» breaches affecting thousands of Norwegian dating app users, The Daily Hodl reports.

The graffiti in detail

Between July 2018 and April 2020, Xandr operated real-time advertising auctions inside Grindr, the popular dating platform for gay, bisexual, trans and queer people. The damning investigation revealed that:

• Sensitive user data including sexual orientation was relayed to potentially thousands of companies
• Advertisers could bid against each other to show targeted ads based on this intimate information
• Users had no idea their private data was being auctioned off
• Simply being identified as a Grindr user was treated as revealing someone’s sexual orientation

Line Coll, director general of the Norwegian regulator, declared to VG : «We issued such a high fine in this case because the breaches we identified were very serious. Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data».

Microsoft’s defence

A Microsoft spokesperson told BleepingComputer the misconduct predated their acquisition of Xandr, with the tech giant now reviewing the decision and considering appeal options according to BleepingComputer. 

Xandr claimed they believed Grindr had already obtained proper consent from users, but the regulator rejected this defence outright. The authority found both companies were joint controllers of the data, meaning Xandr couldn’t simply shift the blame.

«Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing», Coll stated firmly.

Record penalties stack up

This isn’t the first time Grindr’s privacy practices have faced scrutiny:

The regulator emphasised the fine was calculated based on Xandr’s own annual turnover, not Microsoft’s overall revenue, though Microsoft acquired Xandr after the offending period NRK reports.

What happens next

Xandr has three weeks to appeal the landmark decision. Meanwhile, privacy advocates are hailing the ruling as a crucial precedent against the online surveillance advertising industry.

Austrian data privacy organisation noyb called the decision “a valuable precedent” that shows companies trading in people’s data cannot simply pass responsibility to others.

The bottom line

This case lays bare how your most sensitive personal details can be quietly commodified behind the scenes of everyday apps. Even if you never explicitly disclosed your sexual orientation on Grindr, the regulator ruled that being identified as a user constituted special category data warranting extra protection under GDPR.

For millions of app users wondering who knows what about them, the answer might be far more companies than you’d imagine.

Sources: The Daily Hodl, VG, BleepingComputer, NRK