Norway fines Microsoft's Xandr $9.6 million over Grindr data sharing

The Norwegian data protection authority has imposed a substantial fine of $9.61 million on Microsoft's adtech subsidiary, Xandr, for unlawfully transmitting sensitive data of Grindr users to numerous advertisers between July 2018 and April 2020. This is the largest fine ever issued by the Norwegian authority, and it specifically targets advertising intermediaries rather than the app itself. The regulator asserts that entities dealing in people's data cannot evade accountability by placing blame on others.

The fine was levied against Xandr, not Microsoft, as Microsoft did not own Xandr at the time of the alleged infringement. Xandr has been granted three weeks to appeal the decision. The authority concluded that Xandr shared legal responsibility with Grindr, despite Xandr's claim that it presumed Grindr had obtained users' consent without conducting any verification.

Microsoft expressed that the privacy of users is a top priority, emphasizing that the investigation and ruling focus on conduct that occurred before Microsoft's acquisition of Xandr. The company is currently reviewing the decision and exploring its options. The case was initiated by a 2020 complaint from the Norwegian Consumer Council and Austrian data privacy organization noyb, with the latter describing the ruling as "a valuable precedent."