Norway fines Xandr over unconsented Grindr data in ad auctions
Norwegian regulator penalises Microsoft-owned Xandr for sharing sensitive user data through advertising systems without valid consent.
Key points
- Norway's Datatilsynet fined Xandr 92 million kroner, approximately $9.6 million.
- The violation involved real-time ad auctions between July 2018 and April 2020.
- Xandr failed to verify valid consent for processing data revealing sexual orientation.
Norway’s privacy regulator, Datatilsynet, has imposed a fine of 92 million Norwegian kroner, roughly $9.6 million, on advertising technology firm Xandr. The penalty stems from the unlawful processing and dissemination of sensitive information pertaining to Grindr users. Although the enforcement action originates from Norway, the underlying data-sharing practices were not restricted to Norwegian users. BleepingComputer reports that user data from other nations was also exposed through the advertising infrastructure.
Root cause
The core issue lay in Xandr’s reliance on Grindr to obtain user consent without independently verifying its validity. Datatilsynet determined that Xandr, as a joint controller, held distinct obligations regarding data protection. Merely assuming the app had secured explicit consent was insufficient. The regulator noted that simply being identified as a Grindr user constituted information indicating sexual orientation, even if users did not explicitly disclose this in their profiles.
Attack path
This was not a breach involving hackers breaching a dating application. Instead, the data flowed through Xandr’s real-time advertising auctions between July 2018 and April 2020. These automated systems allowed advertisers to bid for ad placements while circulating user data. Sensitive information could potentially reach thousands of companies involved in the auction process. Privacy group noyb, which filed the complaint with the Norwegian Consumer Council, stated these systems use tracking identifiers to build behavioural profiles.
Affected versions
- Real-time advertising auctions involving Grindr users.
- Data processing activities between July 2018 and April 2020.
- Xandr’s advertising technology platform prior to Microsoft’s acquisition.
Mitigation
- Xandr must comply with the regulatory fine and decision.
- Microsoft is currently reviewing the decision and assessing its options.
- No technical patch exists; this is a legal and procedural compliance failure.
What to do and how to stay safe: Xandr
- Limit data disclosure by providing dating apps only essential information.
- Leave optional profile fields blank to reduce personal exposure.
- Avoid publishing workplace, address, or schedule details.
- Refrain from linking social accounts that reveal additional identity markers.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Microsoft acquire Xandr before the violations occurred?
No, Microsoft completed the acquisition on 6 June 2022, more than two years after the period covered by the fine.
