Norway fines Xandr for relaying Grindr users' data

Norway's Data Protection Authority, Datatilsynet, has fined the advertising technology company Xandr NOK 92 million, about €8.6 million. It is the largest fine the authority has issued. Xandr was known as AppNexus at the time of the conduct and is now part of Microsoft.

The case is about real-time bidding inside Grindr, the dating app for gay, bi, trans and queer people. When a user opened the app, Xandr — acting on both the buying and the selling side — relayed personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of companies bidding to show an ad. The authority notes that simply being a Grindr user is information that indicates sexual orientation, which enjoys special protection.

Xandr's defence was that it believed Grindr had collected consent. The authority rejected that. It found Xandr to be a joint controller with Grindr, held that explicit consent was required, and concluded Xandr had done nothing to check the consents were valid or to secure its own legal basis. Director General Line Coll's point was that responsibility for data protection cannot be passed on: each company must be able to document that its own processing is lawful.

Several factors pushed the amount up:

• The infringements ran for almost two years, from July 2018 to April 2020.
• Xandr drew a direct financial benefit from the unlawful sharing.
• The fine was calculated on Xandr's own annual turnover, not Microsoft's, since Xandr was not part of Microsoft during the period.

The case began with a 2020 complaint by the Norwegian Consumer Council. Grindr itself was fined NOK 65 million for equivalent breaches in 2021. Xandr has three weeks from receiving the decision to appeal.