Coverage from Bleeping Computer indicates that Norway’s Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, $9.6 million for unlawfully processing and sharing sensitive data belonging to Grindr users in the country.
The Norwegian authority stated this is the largest fine it has ever issued, citing the serious nature of the breaches. Between July 2018 and April 2020, Xandr managed real-time advertising auctions within Grindr, potentially exposing users’ sensitive sexual orientation information to thousands of companies. Xandr, acting as an intermediary and joint controller with Grindr, failed to verify if Grindr had obtained valid user consent for this data processing. Consequently, sensitive information from Grindr users was shared with advertisers without explicit consent. Privacy organizations like Noyb applauded the decision, calling it a significant blow to the online adtech industry and a step towards holding companies accountable for such practices. Xandr, now operating as Microsoft Advertising, has three weeks to appeal the decision. A Microsoft spokesperson noted the investigation focused on conduct prior to their acquisition of Xandr and that the company is reviewing the decision.
Source: Bleeping Computer
