An advertising company now owned by Microsoft has been hit with Norway's largest-ever privacy fine for passing along sensitive data from users of a dating app built for the LGBTQ+ community.
The Norwegian Data Protection Authority fined Xandr approximately $9.6 million for processing and sharing the personal data of Grindr users without a legal basis.
From July 2018 to April 2020, Xandr participated in real-time ad bidding on both the buyer and seller side, relaying Grindr users' data—including details revealing their sexual orientation—to potentially thousands of companies. Advertisers could then bid against each other to show those users targeted ads.
The regulator rejected Xandr's defense that it believed Grindr had already collected consent, finding the two companies were joint controllers of the data. Xandr failed to verify that consents from Grindr were valid and did not ensure it had a legal basis for its own processing.
The Norwegian Data Protection Authority cited the seriousness of the breaches, noting that thousands of users in Norway were subjected to unlawful sharing of their sensitive data. The authority based the penalty on factors including the direct financial benefit Xandr gained and the nearly two-year duration of the practice, calculating the fine based on Xandr's own annual turnover rather than Microsoft's.
A Microsoft spokesperson told BleepingComputer that the case covers conduct from before Microsoft acquired Xandr and that the company is reviewing the decision and assessing its options. Xandr has three weeks to appeal.
The case began in 2020 following a complaint from the Norwegian Consumer Council.
