Norway fine Xandr €8.6 million for sensitive Grindr data shared in RTB without legal basis

The Norwegian Data Protection Authority (Datatilsynet) has imposed an administrative fine of €8.6 million on Xandr - the Microsoft-linked advertising unit - for having transmitted sensitive data from Grindr users to third parties without an adequate legal basis. The regulatory body qualifies the infringement as "very serious": the facts investigated occurred between July 2018 and April 2020 and, according to the decision, Xandr served as an intermediary in real-time bid processes (real-time bidding, RTB) that disseminated data that could reveal the sexual orientation of users to potentially thousands of actors in the advertising ecosystem.

Facts confirmed: Datatilsynet concluded that Xandr acted as a joint controller with Grindr and should therefore have verified and assured the explicit consent of those affected before processing and reporting such data; instead, Xandr assumed that Grindr had collected that consent. The fine of €8.6 million is the largest imposed so far by the Norwegian authority, and Xandr has three weeks to appeal. Privacy groups, such as None Of Your Business (noyb), had brought the demand to regulators along with the Norwegian consumer council.

How the data leak worked technically: The core of the problem is RTB, the system by which advertising spaces are auctioned in milliseconds when a user loads a page or an app. In an RTB auction, the platform that you intermediate (in this case Xandr) transmits a signal package to multiple buyers - ad identifiers, session metadata, and in this case information derived from the user profile - for advertisers to make offers. This mass transmission involves sharing data with many suppliers and requires strict control of which attributes are included and on which legal basis they are processed. According to the resolution, between July 2018 and April 2020, Grindr data that could involve sexual orientation were disseminated to many buyers through Xandr, without Xandr having verified the legally required consent.

Those who are affected and why it matters: those directly affected are users of Grindr in Norway whose signals or attributes were transmitted in RTB. However, the practical scope is greater: when sensitive data come out of an app to hundreds or thousands of advertising actors, the risk is not only to receive targeted ads; there is the possibility of reidentification by crossing these signals with other data sets, which can lead to unintentional departures from the closet, discrimination, blackmail or stigmatization. In addition, from a systemic perspective, the decision points to the entire chain of advertising intermediaries: if a platform that acts simultaneously for buyers and sellers does not verify the legal basis, it can be held responsible.

The penalty is also part of a regulatory trend that not only pursues individual damage, but also attempts to correct structural failures of the advertising business model based on mass surveillance. The case comes at a time when other companies in the sector and related actors (e.g. Grindr in a UK process) have faced actions and agreements for similar practices.

Actual and predictable consequences: Xandr can appeal immediately and the fine may be reduced or confirmed; Microsoft has stated that it reviews the decision. In practical terms, the resolution creates a legal precedent in the EU / EEA: intermediaries participating in RTB and controlling significant parts of the process could be responsible for ensuring consent and transparency of treatment. For users and advertisers, this may lead to technical changes (reduced transmission of identifying attributes in auctions) and contractual (stricter clauses in contracts between platforms and editors).

What is confirmed and what remains uncertain: confirmed: the fine, the period under investigation, the rating of Xandr as a joint controller during that period and the responsibility for the transmission of sensitive data. Less clear / pending resolution: the exact number of users affected in Norway, the extension of responsibility to Microsoft for facts prior to its acquisition of Xandr, and the scope of the appeal to alter the legal interpretation of responsibilities in RTB. It is also a reasonable estimate - not an official figure - that "thousands" of actors received signals; the authority speaks of potential of mass scope, but the detailed count of recipients may not be published.

For the advertising ecosystem, the resolution implies greater exposure to sanctions if they do not demonstrate active compliance with the General Data Protection Regulation (GDPR) at all stages of the data flow. For the user, it highlights specific risks when using apps that handle sensitive information.

Practical recommendations for users: if you use Grindr or other apps that handle sensitive information, take immediate action: review and adjust the privacy settings of the application (limit profile visibility and data sharing), disable the customization of ads from the operating system (iOS: "Limit Ad Tracking," Android: "Opt out of Ads Personalization"), re-establish your Advertising Identifier (Advertiser ID), and value uninstall the app or create a new profile with minimal data if privacy is a priority. Exercise your rights: ask the controllers (Grindr and to whom appropriate) to access the data they process about you, rectification or deletion and a record of third parties with whom they shared that information. If you reside in the EU / EEA, you can raise complaints with the national data protection authority.

For IT professionals and managers: review contracts with advertising intermediaries and treatment records; implement technical controls to minimize shared data in RTB (e.g., anonymization or writing of sensitive signals), conduct data protection impact assessments (DPIA) specific to RTB and ensure contractual clauses that impose consent verification obligations.

This case is relevant because, in addition to punishing conduct, it requires a rethink of technical and commercial practices in a market that has so far prioritized scale and speed over granular privacy control. Users must protect their sensitive data with practical tools and advertising operators must demonstrate technical and contractual changes or take greater legal risks.

For more institutional information and the organizations that supported the claim, see the Norwegian Data Protection Authority page. https: / / www.datatilsynet.no and the communications of the defence group NOYB https: / / noyb.eu. Press coverage of the case and its regulatory context can be found in media files such as Reuters https: / / www.reuters.com.