Norway fines Microsoft ad unit $9.6M over Grindr data sharing

Norway’s data protection regulator has fined Microsoft-owned adtech division Xandr $9.6 million for unlawfully processing and passing sensitive Grindr user information, including sexual orientation, to thousands of advertisers via real-time auctions between 2018 and 2020. The authority determined Xandr shared legal responsibility with Grindr but failed to verify user consent. This penalty is the highest the Norwegian authority has issued. Xandr has three weeks to appeal the decision.

• Xandr unlawfully shared Grindr users' sensitive data in ad auctions
• Offense occurred between July 2018 and April 2020
• Norway issued its largest-ever privacy fine
• Xandr failed to verify user consent, regulator says
• Microsoft says the conduct predates its acquisition of Xandr