THE Norwegian Data Protection Authority has fined Xandr, the advertising arm once owned by AT&T and now under Microsoft, €8.6 million (about $9.62 million) for unlawfully relaying Grindr users’ sensitive data to advertisers. The breaches occurred between July 2018 and April 2020, during which Xandr acted as an intermediary in real-time bidding and transmitted Grindr users’ data to potentially thousands of other companies. The authority described the conduct as a “very serious” breach and noted that thousands of Grindr users in Norway were affected.
The DPA found Xandr to be a joint controller with Grindr, meaning it should have obtained users’ consent before processing their data. Rather than establishing a legal basis for its own processing, Xandr asserted that Grindr had already obtained consent, effectively shifting responsibility. The case traces back to a 2020 complaint by Norway’s consumer council and the Austrian privacy NGO NOYB.
The watchdog emphasised that the data could reveal sexual orientation and that advertisers could bid on highly targeted adverts without the user’s awareness. Xandr has three weeks to appeal the decision. Microsoft has said it is reviewing the ruling and considering its options. The decision follows a separate UK settlement by Grindr of £26 million over similar concerns, underscoring ongoing scrutiny of data handling in online advertising and profiling.