Norway fines Microsoft's Xandr $9.6 Million for Grindr Data
The Norwegian data protection authority imposed a 92 million crown penalty on the adtech unit for unlawfully sharing sensitive user data from 2018 to 2020.
Norway Fines Xandr $9.6 Million
Norway's data protection authority has levied a fine of 92 million Norwegian crowns, equivalent to $9.61 million, against Microsoft's adtech division, Xandr. The penalty addresses Xandr's unauthorised transmission of sensitive user data from the dating application Grindr to thousands of advertisers.
This practice, which included information revealing users' sexual orientation, occurred between July 2018 and April 2020. The regulator announced its decision on Monday, marking the largest fine it has ever issued.
Regulator's Stance on Data Responsibility
The Norwegian authority emphasised that companies involved in trading personal data bear direct responsibility for its handling and cannot defer blame to other parties. This action specifically targeted the advertising intermediaries rather than the application platform itself.
For similar breaches, Grindr had previously been fined 65 million crowns by the same authority in 2021, underscoring the consistent regulatory focus on data privacy in the adtech ecosystem.
Xandr's Defence and Microsoft's Response
Xandr stated it had assumed Grindr obtained the necessary user consent and did not independently verify this. The data protection authority rejected this argument, ruling that Xandr shared legal responsibility for the data breaches with Grindr.
Microsoft commented that user privacy remains a key priority, noting that the investigation and decision pertain to conduct predating its acquisition of Xandr. The company is currently reviewing the decision and assessing its available options; Xandr has three weeks to lodge an appeal.
This regulatory action in Norway shows a rising global focus on data privacy within adtech, a sector with significant operations and user bases across Asia. Digital advertising firms and app developers in markets like Singapore, India, and Indonesia face increasing pressure to verify user consent for sensitive data sharing.
Non-compliance could lead to substantial fines, impacting operational costs and market reputation, as demonstrated by Xandr's penalty. Companies must strengthen their due diligence in data partnerships.
This article is journalism, not investment advice; consult a licensed professional before making financial decisions. Market data is indicative, may be delayed, and should be verified with your broker or exchange before use.
Comments.
Comments are moderated. We remove what is unlawful, abusive or off-topic, and and you remain responsible for what you post.
Reader comments open soon. Until then, corrections and responses go to our newsroom, and we publish what we get wrong on Corrections.