Norway fines Xandr $10M for unlawful Grindr data sharing

Xandr: Xandr is Microsoft's advertising technology unit focused on programmatic ad auctions and data services. It relayed Grindr users' sensitive data, including sexual orientation, to advertisers from 2018 to 2020 without verifying consent. The unit assumed Grindr had secured proper consents and has three weeks to appeal the fine. Grindr: Grindr operates a dating application serving the LGBTQIA+ community. Its users' sensitive personal data was shared by Xandr in automated ad auctions without adequate consent verification. The case originated from a 2020 complaint by privacy advocates highlighting app data-sharing practices. Microsoft: Microsoft is a leading technology company offering software, cloud computing, and hardware solutions worldwide. It acquired the adtech firm Xandr in 2021. The company stated that the investigation concerns pre-acquisition conduct and is reviewing the Norwegian regulator's decision while affirming its commitment to user privacy. Enforcement Focus: Norwegian authorities are prioritizing cases involving sensitive categories such as sexual orientation in adtech data flows. Industry Evolution: Legal standards and practices around data consent and sharing have continued to develop since the relevant period. Data Responsibility: Regulators hold advertising intermediaries accountable alongside apps for handling sensitive user data in programmatic auctions.