Norway fines Microsoft's Xandr $9.6 million over Grindr data sharing

Norway's data protection authority has ​fined Microsoft's adtech unit Xandr ​92 million crowns ($9.61 million) for ‌unlawfully relaying ​Grindr users' sensitive data to thousands of advertisers, it said on Monday.

Xandr relayed data revealing the sexual orientation ‌of users of Grindr, a dating app for LGBTQIA+ people, to companies in automated ad auctions from July 2018 to April 2020. It is the biggest fine the Norwegian ‌authority has issued, and targets the advertising middlemen rather than the app itself. ‌The regulator said companies that traded in people's data could not pass the blame to others.

The data protection authority fined Grindr 65 million crowns over the same breaches in 2021. The fine was ⁠based ​on Xandr's revenue, ⁠not Microsoft's, which did not own the unit at the time. Xandr has three weeks to appeal.

Xandr ⁠said it assumed Grindr had obtained users' consent and never checked, the data protection ​authority said. It rejected that argument and ruled Xandr shared legal responsibility with Grindr. Microsoft ⁠said the privacy of users was a top priority.

"This investigation and decision focused on conduct ⁠that predates ​Microsoft's acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing ⁠the decision and assessing our options," it said. The case began with a 2020 complaint ⁠by the Norwegian Consumer ⁠Council, whose research exposed how apps shared user data, and Austrian data privacy organisation noyb, which called the decision "a valuable precedent".

($1 = ‌9.5704 ‌Norwegian crowns)