Norway Fines Microsoft’s Xandr $9.6 Million Over Grindr User Data Sharing
Norway’s Data Protection Authority, Datatilsynet, has fined Microsoft-owned advertising company Xandr $9.6 million (NOK 92 million) for illegally processing and sharing sensitive data belonging to Grindr users.
Datatilsynet said the penalty was the largest fine it had ever issued, citing the seriousness of the violations and the number of people affected.
“The reason we imposed such a high fine in this case is because the violations we identified were so serious,” said Line Coll, executive director of Datatilsynet.
“Thousands of users in Norway have been victims of illegal sharing of sensitive data.”
Grindr advertising auctions exposed sensitive user data
According to the authority’s findings, Xandr managed a real-time advertising auction within Grindr from July 2018 to April 2020. The process could have exposed user data, including sensitive information about sexual orientation, to thousands of companies.
In these auctions, advertisers bid for the opportunity to display ads to Grindr users after receiving profiling information from Xandr, which acted as an intermediary.
At the time, Xandr was a joint data controller with Grindr. This meant the company was responsible for how the data was used and had to request and obtain explicit consent from users for the processing.
Grindr is a location-based dating app that primarily serves the LGBTQ+ community.
Datatilsynet said Xandr assumed that Grindr had obtained valid consent but did not take steps to verify it.
“Xandr failed to check whether the consent from Grindr was valid and did nothing to ensure a legal basis for its processing,” Coll said.
As a result, sensitive information about Grindr users in Norway and other countries was exposed to thousands of advertisers without the users’ knowledge or explicit consent.
Privacy groups welcome Norway’s decision
Austrian nonprofit privacy rights organization noyb filed the initial complaint in January 2020 with the Norwegian Consumer Council. The consumer organization praised Datatilsynet’s decision, calling it a “major blow to the online ad tech industry.”
The groups said the decision could help stop practices involving the unrestricted and secret exchange of sensitive user data between websites, apps, platforms and operating systems.
“This fine shows that companies like Xandr will finally be held accountable for their shady practices,” noyb said.
“Profiling people’s interests, habits, location, and behavior requires valid consent, which ad tech companies rarely obtain.”
Microsoft says investigation predates its acquisition
Xandr, now operating as Microsoft Advertising, was given three weeks to respond to the decision.
BleepingComputer contacted Microsoft for comment on the Norwegian agency’s decision. A spokesperson stressed that the investigation and its findings “focus on conduct prior to Microsoft’s acquisition of Xandr.”
The spokesperson said the legal framework and the way it is interpreted and enforced have changed since then. Microsoft is “reviewing the decision and evaluating its options.”
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com