Xandr fined $9.6 million by Norway over Grindr data sharing

Norway’s Data Protection Authority (Datatilsynet) has issued a record fine of 92 million Norwegian kroner (approximately $9.6 million or €8.6 million) to Xandr, an advertising technology subsidiary owned by Microsoft. The penalty follows findings that Xandr unlawfully processed and shared sensitive personal data from users of the LGBTQ+ dating app Grindr.

Between July 2018 and April 2020, Xandr participated in real-time bidding auctions that relayed user information—including data revealing sexual orientation—to potentially thousands of companies in the advertising ecosystem. The regulator determined that Xandr acted as a joint controller with Grindr and failed to verify that valid, explicit consent had been obtained from users.

Datatilsynet emphasized that data protection responsibility cannot be delegated to third parties. Xandr, which was known as AppNexus during the period in question, has three weeks to appeal the decision. The fine was calculated based on Xandr’s own turnover rather than Microsoft’s, as the acquisition by Microsoft occurred after the period of the infringements.