Microsoft-owned advertising technology company Xandr has been fined NOK 92 million, approximately €8.6 million, by the Norwegian Data Protection Authority for unlawfully processing personal data belonging to Grindr users in Norway.
The penalty is the largest administrative fine issued by the Norwegian regulator to date. The authority found that Xandr shared sensitive user information, including data revealing sexual orientation, through an advertising ecosystem that could expose it to potentially thousands of companies. The decision follows complaints filed in 2020 by the Norwegian Consumer Council in cooperation with privacy organisation noyb.
The case centres on whether an advertising intermediary can rely on an app provider’s assurances about user consent. The regulator concluded that Xandr had an independent responsibility to establish and document a lawful basis for its processing.
Grindr User Data Entered Real-Time Advertising Auctions
Xandr, previously known as AppNexus and now part of Microsoft, participated on both the buying and selling sides of real-time bidding, the automated process used to auction digital advertising space.
When users opened Grindr, their personal information could pass through Xandr to numerous participants in the advertising market. Advertisers could then compete to display targeted advertisements, with transactions taking place in a fraction of a second.
The regulator found that Xandr lacked a legal basis to process the personal data of Grindr users in Norway.
Grindr is a location-based dating app aimed at gay, bisexual, transgender and queer people. The authority determined that information identifying someone as a Grindr user can indicate sexual orientation and therefore requires special protection.
The underlying complaints also raised concerns about the sharing of GPS location and device identifiers. Combining such information with other data can enable advertising companies to construct detailed profiles of individuals.
Xandr Failed to Verify Explicit Consent
The Norwegian Data Protection Authority concluded that explicit consent was required for the processing examined in the case. However, Xandr had not taken the necessary steps to verify that valid consent existed.
The company argued that it believed Grindr had obtained users’ consent. The regulator rejected that position, finding that Xandr could not transfer responsibility for its own processing to another participant in the advertising chain.
It also determined that Xandr and Grindr were joint controllers.
That finding places accountability at the centre of the decision. Companies handling personal information must assess whether their own activities are lawful and retain evidence supporting that assessment.
Line Coll, Director General of the Norwegian Data Protection Authority, said the seriousness of the breaches justified the substantial penalty. Thousands of Norwegian users had been subjected to unlawful sharing of sensitive information, according to the authority.
Nearly Two Years of Violations Increased the Fine
The unlawful processing took place from July 2018 to April 2020, a period of almost two years.
The regulator treated the duration as an aggravating factor when calculating the penalty. It also considered the direct financial benefit Xandr obtained from the unlawful sharing of personal data.
Xandr’s position as a major advertising technology business was another consideration. Processing personal information is central to its business model, making compliance directly relevant to its core operations.
The authority calculated the fine using Xandr’s own total annual turnover. It did not use Microsoft’s turnover because Xandr was not part of Microsoft during the period covered by the infringements.
Xandr has three weeks from receipt of the decision to appeal.
Case Builds on Grindr’s NOK 65 Million Penalty
The Xandr decision follows a separate NOK 65 million fine imposed on Grindr in 2021 for equivalent breaches. The Borgarting Court of Appeal subsequently upheld that penalty.
The investigation originated in the Norwegian Consumer Council’s 2020 examination of data sharing by smartphone apps. Working with noyb, the council filed complaints involving Grindr and five advertising technology companies: MoPub, AppNexus, OpenX, AdColony and Smaato.
Those complaints challenged the collection, transmission and use of personal information for advertising under the General Data Protection Regulation.
For businesses using programmatic advertising, the Xandr case highlights a concrete compliance issue: consent assurances from a commercial partner do not, by themselves, establish that sensitive data can be lawfully processed.
The regulator’s findings underline the need to verify consent, document responsibility and understand how personal information moves through advertising intermediaries.
BABURAJAN KIZHAKEDATH
