Norway’s Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, $9.6M (NOK 92 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country.
The data protection authority said this is the largest fine it has ever issued.
“We issued such a high fine in this case because the breaches we identified were very serious,” said Line Coll, Director General of Datatilsynet.
“Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.”
According to the authority’s findings, between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that potentially exposed users’ data, including sensitive sexual orientation information, to thousands of companies.
These auctions work by advertisers bidding for the right to display an ad to a Grindr user after they receive profiling information from Xandr, which acted as the intermediary.
At the time, Xandr was a joint controller with Grindr, meaning it was responsible for how the data was used and should have required and obtained explicit consent from the data subjects for this processing.
Grindr is a location-based dating app primarily serving the LGBTQ+ community.
According to Norway’s data privacy agency, Xandr assumed Grindr had obtained valid consent but did not take any action to verify it.
“Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing,” Coll stated.
As a result, sensitive information about Grindr users from Norway and other countries was exposed to thousands of advertisers without the users realizing it, or ever providing explicit consent.
Austrian nonprofit privacy rights organization Noyb, which filed the original complaint in January 2020, together with the Norwegian Consumer Council (Forbrukerrådet), applauded the Datatilsynet decision, calling it “a major blow to the online adtech industry.”
According to the organization, the decision puts a brake to the bad practices of large players in the online advertising and commercial surveillance industry, including the unrestricted and covert exchange of sensitive user data between websites, apps, platforms, and operating systems.
“The current fine shows that companies such as Xandr are eventually held accountable for their shady practices,” Noyb said.
“Profiling people’s interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain.”
Xandr, which now operates as Microsoft Advertising, was given three weeks to appeal the decision.
BleepingComputer contacted Microsoft for a comment on the Norwegian agency’s decision, and a spokesperson underlined that the investigation and the outcome “focused on conduct that predates Microsoft’s acquisition of Xandr.”
Since then, legal frameworks and the way they are interpreted and enforced have changed, the spokesperson said, adding that Microsoft is “reviewing the decision and assessing our options.”
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
