Why is Microsoft’s Xandr facing an €8.5m GDPR fine from Norway?

The short version

• The Norwegian Data Protection Authority has issued a decision fining Microsoft’s Xandr €8.5 million.
• The fine addresses violations of the General Data Protection Regulation regarding data from the dating app Grindr.
• The ruling stems from complaints lodged in 2020 by privacy advocates noyb and the Norwegian Consumer Council.

The details

The Norwegian Data Protection Authority has ruled that Microsoft’s advertising unit, Xandr, breached data protection laws. The regulator imposed a fine of €8.5 million, equivalent to NOK 92 million, for these violations according to the authority’s press release. The decision marks a significant enforcement action against the online advertising technology sector.

The core issue involves the processing of personal data obtained from users of the dating application Grindr. The authority determined that Xandr handled this information without a valid legal basis. This included sensitive data points such as users’ sexual orientation. The ruling confirms that the adtech company failed to meet the strict requirements for handling such private information under GDPR rules.

The context

In 2020, the Norwegian Consumer Council and noyb filed three separate complaints regarding data flows from Grindr. These complaints targeted the dating app itself and several advertising partners that received user data. One specific complaint focused on Xandr, which is now part of Microsoft. The advocates highlighted how smartphone apps often send detailed behavioural data to numerous tracking partners.

A report by the Norwegian Consumer Council previously revealed that apps transmit interests, habits and behaviour to many entities. This data is used to build comprehensive profiles for targeted advertising. Felix Mikolasch, a lawyer at noyb, welcomed the decision as a valuable precedent. He noted that adtech companies often operate in the background and are rarely held accountable for their practices.

Next steps

The decision serves as a warning to the commercial surveillance industry. Many platforms and operating systems send user data to adtech firms for profiling. The current fine demonstrates that companies can be held liable for these activities. Profiling requires valid consent, which the material suggests adtech companies rarely obtain. This ruling may encourage further scrutiny of data flows between apps and advertising partners.

What to do and how to stay safe: Microsoft

• Review the privacy settings of your dating and lifestyle apps to limit data sharing with third-party advertisers.
• Check your device’s advertising ID settings to opt out of personalised ad tracking where possible.
• Monitor official notifications from app developers regarding changes to their data processing policies.
• Report suspicious data handling practices to your local data protection authority if you suspect misuse.

Step-by-step guide: How Dark Web Monitoring Works: The Hidden Mechanics and Limits

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much was the fine imposed on Xandr?

The Norwegian Data Protection Authority fined Xandr €8.5 million, which is approximately NOK 92 million.

What specific data did Xandr process incorrectly?

Xandr processed personal data from Grindr users, including sensitive information regarding sexual orientation, without a legal basis.

Who filed the original complaint against Xandr?

The complaint was filed in 2020 by noyb in cooperation with the Norwegian Consumer Council.