The Norwegian Data Protection Authority (NDPA) fined Microsoft’s subsidiary Xandr, which operates in the field of advertising technologies, with 92 million Norwegian kroner (approximately $9.6 million) for using sensitive personal data of Grindr users for advertising purposes without obtaining the necessary permissions. The agency stated that Xandr assumed that the dating app Grindr had previously obtained the necessary permissions, rather than directly verifying users’ explicit consent. The decision in question was recorded as the highest fine ever imposed by the Norwegian Data Protection Authority. The review focuses on how personal data is shared in the digital advertising ecosystem and to what extent users are informed in this process. The decision contains remarkable details regarding the application of the explicit consent requirement, especially in the processing of sensitive personal information for targeted advertising.
According to the statement of the Norwegian Data Protection Authority, the personal information of users who opened the Grindr application was, in many cases, transferred to potentially thousands of different parties in the advertising ecosystem through Xandr’s advertising technology infrastructure. Thanks to this information, advertisers could compete with each other to show targeted ads to users. However, these transactions were carried out without the knowledge of the people whose personal data were used. The institution emphasized that this process for serving ads is completely invisible to users. Thus, users could not adequately track which companies their data reached and in which advertising processes it was evaluated.
Investigation into Xandr’s use of Grindr data began in 2020
The review of Xandr dates back to 2020. The Norwegian Consumer Council filed a complaint with the Norwegian Data Protection Authority, alleging that the company shared personal data of Grindr users for commercial purposes without obtaining the necessary consents. At the time the investigation began, Xandr was not yet within Microsoft. The complaint alleged that explicit consent requirements were not met when transferring user data between ad technology companies. The investigation carried out by the institution later covered data processing activities between July 2018 and April 2020.
The Norwegian Data Protection Authority justified the high fine imposed on Xandr by the seriousness of the violations. According to the institution, using users’ sensitive personal information for advertising purposes without sufficient legal basis constitutes a serious violation of the protection of personal data. Xandr’s total annual turnover was taken as basis in determining the fine. In addition, the company’s reliance on user permissions assumed to have been obtained by Grindr was also effective in the evaluation. Within the scope of data protection regulations, the explicit consent required to process sensitive personal data must be validly obtained and proven when necessary.
At the center of the dossier is the real-time bidding system widely used in the digital advertising industry. In this system, when a user visits the application or website, automatic bids for advertising spaces can be collected in a very short time. Advertisers can bid on which ad to show based on the user information and targeting criteria provided. However, transferring user information between different companies in the advertising system may pose various risks in terms of protecting personal data. Processing of application usage data, especially those that can be associated with sensitive information such as sexual orientation, may be subject to stricter legal conditions than ordinary ad targeting data.
Grindr has also faced sanctions in the past for unauthorized sharing of user data. The Norwegian Data Protection Authority had previously fined the dating app approximately $6.2 million, exceeding 5.6 million euros, on similar grounds. In addition, the company faced allegations that it shared sensitive health information of its users, including their HIV status and test dates, in a lawsuit filed in London in 2024. The allegations in this case and the investigation conducted against Xandr in Norway involve separate legal processes. Despite this, both files raise similar privacy issues regarding the sharing of personal information collected on dating apps with third parties.
The decision on Xandr suggests that it may not be enough for ad tech providers to rely solely on their assumption that app developers have obtained user consent. The purposes for which users’ explicit consent is obtained, with whom the data is shared, and how these transactions are documented are among the determining factors in terms of compliance with data protection legislation. On the other hand, the involvement of many companies in real-time advertising bidding systems makes the circulation of user information and tracking of data processing responsibilities more complicated. The assessment of the Norwegian authorities also focuses on the obligations of companies operating in such systems in data processing processes. The penalty highlights the responsibility of ad tech companies to verify valid user consent, especially when sensitive personal data is involved.