Norway slaps Microsoft ad unit with $9.6M fine over Grindr data

Norway's Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, 92 million Norwegian kroner ($9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country.

The regulator stressed this is the largest fine it has ever issued. "We issued such a high fine in this case because the breaches we identified were very serious," said Datatilsynet Director General Line Coll. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."

Real-time ad auctions

According to the authority's findings, between July 2018 and April 2020 Xandr managed real-time advertising auctions inside Grindr that potentially exposed users' data — including sensitive sexual orientation information — to thousands of companies. In these auctions advertisers bid for the right to display an ad to a particular user after first receiving profiling information from Xandr, which acted as the intermediary.

Grindr is a location-based dating app serving primarily the LGBTQ+ community, so merely using it already reveals sensitive information.

At the time, Xandr was a joint controller alongside Grindr, meaning it was responsible for how the data was used and should have obtained explicit consent from users. The regulator found that Xandr assumed Grindr had collected valid consent but did nothing to verify it. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll said.

'A blow to the industry'

The original complaint was filed back in January 2020 by Austrian privacy rights group Noyb together with the Norwegian Consumer Council. Both welcomed the decision, calling it "a major blow to the online adtech industry." According to Noyb, the ruling puts a brake on the covert exchange of sensitive user data between websites, apps, platforms, and operating systems. "Profiling people's interests, habits, location, and behavior requires valid consent — which adtech companies hardly ever obtain," the group said.

Xandr, which now operates as Microsoft Advertising, was given three weeks to appeal. A Microsoft spokesperson stressed that the investigation concerned conduct that predates the company's acquisition of Xandr. Legal frameworks and their enforcement have since changed, the spokesperson added, noting that Microsoft is "reviewing the decision and assessing our options."

Source: Bleeping Computer