The Norwegian Data Protection Authority has imposed a significant fine of €8.6 million on Xandr, a Microsoft-owned advertising entity, for unlawfully transmitting Grindr users’ sensitive information to advertisers. This fine marks the largest ever issued by the Norwegian regulator, underscoring the gravity of the violation. The infractions were identified to have occurred between July 2018 and April 2020.
Xandr’s Role in Data Transmission
According to the Data Protection Authority, Xandr functioned as an intermediary, conveying the personal data of Grindr users in Norway, including information indicating sexual orientation, to potentially thousands of other firms. The investigation revealed that Xandr was jointly responsible with Grindr for securing users’ consent before processing their data, a responsibility they failed to fulfill. Instead, Xandr placed the onus on Grindr, claiming the dating app had obtained the necessary permissions.
Formed by AT&T after acquiring AppNexus in 2018, Xandr’s name pays homage to AT&T’s founder, Alexander Graham Bell. In late 2021, Microsoft acquired Xandr, and by June 2023, the brand had been absorbed under Microsoft Ads. The case against Xandr was brought to light in 2020 following a complaint by Norway’s consumer council and the Austrian privacy group None of Your Business (noyb), accusing Xandr of unauthorized data sharing for commercial purposes.
Real-Time Bidding Controversy
The watchdog highlighted Xandr’s participation in real-time bidding processes, where user data was passed through Xandr to various actors in the advertising sector. This allowed advertisers to competitively bid to display targeted ads, unbeknownst to the users. The DPA determined the fine by considering Xandr’s annual revenue during the two-year span preceding Microsoft’s acquisition.
After the penalty announcement, noyb labeled it a significant setback for the online advertising and surveillance sector, emphasizing the accountability of companies like Xandr for their opaque practices. Microsoft, in response, stated that it is evaluating the decision and its potential courses of action.
Wider Implications for Data Privacy
In a related development, Grindr recently agreed to a £26 million settlement in the U.K. over similar allegations of data sharing without consent, including sensitive health information. Meanwhile, AT&T concluded a $177 million settlement concerning data breaches affecting millions of its customers, demonstrating the growing scrutiny and legal repercussions companies face over data privacy issues.
These cases highlight the increasing importance of stringent data protection measures and the accountability of corporations in safeguarding user privacy. As regulatory bodies continue to enforce compliance, companies in the digital advertising space must reassess their data handling practices to align with evolving privacy standards.
