The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers.

The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements occurred between July 2018 and April 2020.

"Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies," the Data Protection Authority said in a statement.

The data protection authority said its investigation found that Xandr was a joint controller with Grindr, which meant it was responsible for obtaining users' consent before processing their data.

Instead of ensuring they had the legal basis for their own processing of the data, Xandr pointed fingers at Grindr, stating it assumed the online dating app had collected users' consent to do so," it added.

Xandr was formed by AT&T following its June 2018 acquisition of AppNexus. The name is a reference to Alexander Graham Bell, who founded AT&T in 1885. It was subsequently sold to Microsoft in late December 2021, following which the brand was retired and consolidated under the Microsoft Ads umbrella in June 2023.

The case dates back to 2020, when the country's consumer council, along with Austrian privacy non-profit None of Your Business (noyb), filed a complaint against Xandr, accusing it of unlawfully sharing users' personal data for commercial purposes without getting users' explicit consent.

Source link