Norway fines Microsoft’s Xandr US$9.6mil over Grindr data sharing

The Norwegian data protection authority has imposed a substantial fine of 92 million crowns, equivalent to US$9.61 million, on Microsoft's adtech unit Xandr for unlawfully transmitting sensitive data from the dating app Grindr to hundreds of advertisers. The breach occurred between July 2018 and April 2020, making it the largest fine ever issued by the Norwegian authority.

Xandr, which relayed user data indicating sexual orientation to advertisers in automated auctions, has three weeks to appeal the decision. The regulator emphasized that data trading companies cannot shift blame to others. Grindr itself was fined 65 million crowns for the same breaches in 2021. Microsoft maintained that user privacy is a top priority, noting that the investigation and decision relate to practices before its acquisition of Xandr.

The data protection authority rejected Xandr's argument that it assumed Grindr obtained user consent and determined that Xandr shared legal responsibility with the dating app. Microsoft is reviewing the decision and evaluating its options. The case originated from a 2020 complaint by the Norwegian Consumer Council and Austrian data privacy group noyb, with the decision hailed as a "valuable precedent."