The Norwegian regulator found that between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that potentially exposed users' data, including sensitive sexual orientation information, to thousands of companies.
At the time, Xandr acted as an intermediary in ad auctions in which advertisers bid to display an ad to a Grindr user after receiving profiling information. According to Datatilsynet, Xandr was a joint controller with Grindr and was responsible for how the data was used, meaning it should have obtained explicit consent from users.
"Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," said Line Coll, Director General of Datatilsynet. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."
Grindr is a location-based dating app primarily serving the LGBTQ+ community. The regulator said Xandr assumed Grindr had obtained valid consent but took no action to verify it, leaving sensitive information exposed to advertisers without users' knowledge or explicit consent.
Austrian privacy rights group Noyb, which filed the original complaint in January 2020 alongside the Norwegian Consumer Council, welcomed the decision, calling it "a major blow to the online adtech industry." The group said the fine shows companies such as Xandr are "eventually held accountable for their shady practices," adding that profiling people's interests, habits, location and behaviour requires valid consent, "which adtech companies hardly ever obtain."
Xandr, which now operates as Microsoft Advertising, has three weeks to appeal the decision. A Microsoft spokesperson said the investigation and outcome "focused on conduct that predates Microsoft's acquisition of Xandr," and that legal frameworks and their interpretation have changed since then. The company said it is "reviewing the decision and assessing our options."