Norwegian regulators have fined Xandr $9.6 million for unauthorized data sharing practices between 2018 and 2020.
The ad-tech firm, now a Microsoft subsidiary, was found to have distributed Grindr user data to thousands of third-party advertisers without explicit consent.
This development highlights the complex data governance challenges inherent in programmatic advertising supply chains and the increasing regulatory scrutiny on how personal identifiers are handled by intermediaries.
What happened to user data?
The case concerns how Xandr handled personal data of users of the dating app Grindr from July 2018 to April 2020. According to the Norwegian authority, the company did not obtain the users' explicit permission to use their information for the purpose of displaying advertisements.
In practice, this meant that once a user used Grindr, their personal data was routed through Xandr to thousands of other advertising companies. This allowed advertisers to target users with ads without them knowing that their information was being shared.
The course of the case and the company's position
The complaint was launched in 2020 by the Norwegian Consumer Council, before Xandr was acquired by Microsoft. The company has three weeks to appeal the decision.
The consequences for Grindr too
This is not the first time that Norwegian authorities have investigated similar practices on the same app. Grindr itself has been fined $6,2 million (€5,6 million) for similar reasons. In addition, in 2024, the app faced a lawsuit in London, which concerned the leakage of sensitive personal data, such as users' HIV status.
Top comments (0)