NORWAY’S data protection regulator, Datatilsynet, has fined the advertising technology firm Xandr 92 million Norwegian kroner (about $9.6 million) for unlawfully processing and sharing sensitive information about Grindr users. The enforcement concerns Grindr users in Norway, but the article notes that the data-sharing practices were not limited to Norwegians and that information about Grindr users in other countries was exposed through the ad auction system.
Between July 2018 and April 2020, Xandr ran real-time advertising auctions that, in addition to bidding for ads, circulated data about the individual who would see the ad. This could reveal sensitive details such as sexual orientation, and the data could reach thousands of companies, even if users did not disclose their orientation in their profiles.
Datatilsynet found that Xandr relied on Grindr to obtain user consent without verifying that consent was valid, placing responsibility on Xandr as a processor with independent obligations. The case emphasizes that the information in play could be inferred from being identified as a Grindr user, not merely from profile content. The fine predates Microsoft’s acquisition of Xandr on 6 June 2022, but Microsoft said it was reviewing the decision and assessing options.
The report also highlights that such data flows can cross borders, meaning affected individuals in the US and elsewhere should not assume their information remained private merely because a Norwegian fine was issued.