Xandr Fined $9.6 Million Over Grindr Data Sharing in Norway

Norway’s data-protection regulator fined Xandr, now part of Microsoft, about $9.6 million after finding that it unlawfully processed and shared sensitive Grindr user data.

The penalty covers conduct from July 2018 to April 2020, when Xandr participated in real-time advertising auctions on both the buying and selling sides. User information from Grindr, a location-based dating app for gay, bisexual, transgender and queer people, was passed to potentially thousands of companies for targeted advertising.

The Norwegian Data Protection Authority determined that the information included details revealing users’ sexual orientation. It also rejected Xandr’s position that Grindr had already obtained the necessary consent, concluding that the two companies shared responsibility for processing the data.

Line Coll, director general of the Norwegian Data Protection Authority, said the regulator considered the violations serious because thousands of people in Norway were affected by the unlawful sharing of sensitive information. Coll also said Xandr failed to verify whether Grindr’s consents were valid and did not establish a legal basis for its own processing.

The regulator increased the penalty because of Xandr’s direct financial benefit and the nearly two-year duration of the conduct. The fine was calculated using Xandr’s annual turnover rather than Microsoft’s.

Microsoft said the conduct occurred before it acquired Xandr and that it is reviewing the decision. Xandr has three weeks to appeal.