Record €8.6 Million Privacy Fine Shows Businesses Cannot Pass the Buck on Customer Consent

The Norwegian Data Protection Authority has fined Xandr, an advertising unit owned by Microsoft, €8.6 million (about $9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. It is the largest penalty the regulator has issued, and it said the "very serious" nature of the breach justified the amount. The infringements took place between July 2018 and April 2020, before Microsoft acquired the business.

The regulator found that Xandr acted as an intermediary in real-time bidding, where it was on both the buyer and seller side. When a person opened Grindr, their personal data, including data revealing sexual orientation, was in many cases passed through Xandr to potentially thousands of companies in the advertising ecosystem. Advertisers could then bid to show targeted ads, with the process hidden from the user. The case began in 2020 with a complaint from Norway's consumer council and privacy group noyb.

A key finding was that Xandr was a joint controller with Grindr, meaning it was responsible for making sure users had consented. Xandr argued it had assumed Grindr had collected that consent, but the regulator did not accept this. The fine was calculated using Xandr's total annual turnover over the two-year period. Xandr has three weeks to appeal.