Key points
- Norwegian regulator fined Microsoft’s Xandr €8.5 million for GDPR violations related to Grindr data.
- The penalty stems from processing sensitive sexual orientation data without a valid legal basis.
- Complaints were originally filed in 2020 by noyb and the Norwegian Consumer Council against multiple entities.
The Norwegian Data Protection Authority has imposed an €8.5 million fine on Microsoft’s advertising unit, Xandr, for violating the General Data Protection Regulation. The penalty addresses the company’s processing of personal data obtained from the dating application Grindr, including sensitive information regarding users’ sexual orientation. The regulator determined that Xandr lacked a valid legal basis for this data handling, marking a significant enforcement action against the online advertising sector’s data practices.
This decision concludes a legal process that began in 2020 when the European privacy advocacy group noyb, in cooperation with the Norwegian Consumer Council, filed formal complaints. The initial filings targeted Grindr and several adtech partners, including Xandr, which is now part of Microsoft. The complaints alleged that the app and its partners shared highly personal user information with thousands of advertising partners via online tracking IDs without proper consent or legal justification.
What we know
The Norwegian Consumer Council previously reported that smartphone applications frequently transmit personal data about user interests, habits, and behavior to numerous external entities. These data flows allow third parties to create comprehensive profiles for targeted advertising purposes. The current ruling highlights the risks associated with such widespread data sharing, particularly when sensitive categories like sexual orientation are involved without explicit user authorization.
Felix Mikolasch, a data protection lawyer at noyb, welcomed the authority’s decision, noting that online adtech companies often operate in the background with limited accountability. He stated that this outcome sets a valuable precedent for similar cases involving data privacy violations. The fine demonstrates that regulators are willing to penalize companies that engage in commercial surveillance practices without obtaining valid consent from users whose data is being profiled and shared.
Defender's checklist
- Audit third-party data sharing agreements to ensure they specify lawful bases for processing personal information.
- Review consent mechanisms to verify that users explicitly agree to the collection of sensitive data categories.
- Monitor regulatory updates from European data protection authorities regarding adtech compliance requirements.
- Implement data minimization practices to limit the amount of personal information shared with advertising partners.
What to do and how to stay safe: Microsoft
- Review your application’s data sharing policies to confirm that sensitive user data is not transmitted to adtech partners without explicit, informed consent.
- Audit all third-party tracking integrations to ensure they comply with current GDPR requirements and that legal bases for processing are documented.
- Update privacy notices to clearly disclose how user data, including sexual orientation or other sensitive attributes, is shared with external advertising networks.
- Once the vendor provides an update or guidance, implement technical controls to restrict data flows to only those partners with verified compliance certifications.
Step-by-step guide: What Causes Data Breaches: The Hidden Mechanics Behind Every Leak
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why was Microsoft’s Xandr fined by the Norwegian Data Protection Authority?
Xandr was fined €8.5 million for violating the GDPR by processing personal data, including sensitive sexual orientation information from Grindr users, without a valid legal basis.
Who filed the original complaint against Xandr and Grindr?
The complaint was filed in 2020 by the European privacy group noyb in cooperation with the Norwegian Consumer Council.
What data was at the center of this enforcement action?
The case involved personal data sent from the Grindr app to advertising partners, including sensitive information about users’ sexual orientation, habits, and behavior.
