Norway’s data protection authority has fined Microsoft’s advertising business Xandr roughly €8.5 million for unlawfully processing personal data obtained from Grindr, according to noyb. The authority found that the processing lacked a valid legal basis and involved sensitive data about users’ sexual orientation. The penalty amounts to NOK 92 million and follows a complaint brought in 2020 by noyb working with the Norwegian Consumer Council.
Xandr was among the advertising companies targeted in three GDPR complaints that the two organizations filed over Grindr and businesses receiving users’ data from the dating app. Microsoft now owns Xandr, which operates in online advertising. According to noyb, the Norwegian authority has issued a decision finding GDPR violations and ordering Xandr to pay the fine.
The complaints followed research by the Norwegian Consumer Council into how smartphone apps distribute information about their users to advertising businesses. That research described information about people’s behavior, interests and habits passing to numerous recipients when they use apps. According to noyb, apps use online tracking IDs to transmit personal information to thousands of advertising partners, which can build detailed profiles for advertising targeting and additional uses.
noyb says the wider profiling system also draws data from websites, platforms and operating systems, with information circulating among thousands of businesses. The organization argues that profiling users’ locations, behavior, habits and interests needs valid consent, which advertising technology businesses rarely secure. Felix Mikolasch, data protection lawyer at noyb, welcomed the ruling as a precedent for other cases involving advertising companies that operate behind the scenes.
The Xandr penalty follows another advertising privacy case: in March, the Conseil d’État upheld a €40 million GDPR fine against Criteo after rejecting its appeal. That case stemmed from complaints noyb and Privacy International filed in December 2018, with the French regulator finding failures involving individuals’ data rights and Criteo’s ability to demonstrate valid consent.
Separately, noyb says the European Commission’s proposed Digital Omnibus would alter GDPR treatment of online tracking IDs following lobbying by technology companies. The organization argues that excluding those identifiers from the law’s scope could prevent companies including Xandr from being held accountable for breaches involving them. The proposal is under discussion in the European Parliament and Council.
