Summary
Norway’s data-protection authority imposed a NOK 92 million fine on Xandr over its processing of Grindr users’ sensitive personal data. The authority said Xandr lacked a legal basis and failed to check that users had given valid consent.
Norway’s Data Protection Authority has imposed an administrative fine of NOK 92 million (€8.6 million) on Xandr over its processing of Grindr users’ personal data. The authority said the advertising technology company had no legal basis for processing the data and had not ensured it had valid consent. It described the penalty as the highest fine it has issued to date.
Xandr is now part of Microsoft, but the conduct covered by the case took place between July 2018 and April 2020, before Xandr became part of the company. The authority said Microsoft’s turnover was not used to calculate the fine.
How Grindr data entered advertising auctions
The case concerns real-time bidding, a system that lets advertisers compete to place targeted ads in websites and apps. When someone opened Grindr, the authority said, personal data was in many cases relayed through Xandr to potentially thousands of companies in the advertising ecosystem. Automated bids could then determine which advert to show, with the process taking place in a fraction of a second.
The data included information that could reveal a user’s sexual orientation. The authority noted that being a Grindr user can itself indicate sexual orientation, making this sensitive personal data. It said the information was shared without users being able to see the advertising transactions taking place.
Why Xandr was fined
The authority concluded that explicit consent was required to process the data, but found that Xandr had not checked whether Grindr had obtained valid consent. Xandr had said it believed Grindr was responsible for collecting consent. The regulator found Xandr to be a joint controller with Grindr and said each company must ensure, and be able to document, that its own processing is lawful.
In setting the penalty, the authority cited the length of time the practice continued, the financial benefit Xandr derived from the processing and the company’s position in the advertising technology sector. It said the fine was intended to be effective, proportionate and dissuasive.
Xandr has three weeks from receiving the decision to appeal.