Norway fines Microsoft's Xandr $9.6 million over Grindr data sharing

Norway's data protection authority has imposed a substantial fine of $9.6 million on Microsoft's adtech unit, Xandr, for unlawfully sharing sensitive data of Grindr users with numerous advertisers. The fine, the largest ever issued by the Norwegian authority, pertains to the period between July 2018 and April 2020 when Xandr relayed data, including users' sexual orientation, to advertisers in automated ad auctions.

This punishment targets the advertising intermediaries rather than the app itself, Grindr. Previously, Grindr was fined 65 million crowns for the same breaches in 2021. The fine is based on Xandr's revenue at the time, not Microsoft's, as the unit was not owned by Microsoft then. Xandr was given three weeks to appeal the decision.

The authority rejected Xandr's claim that it assumed Grindr had obtained users' consent and never checked, ruling them equally responsible for the data sharing. Microsoft emphasized that user privacy is a top priority and stated that the investigation focused on practices that occurred before its acquisition of Xandr. The case initially began with a 2020 complaint by the Norwegian Consumer Council and Austrian data privacy organization noyb, with the latter describing the decision as "a valuable precedent."