Norway imposes $9.6M fine on Xandr over Grindr user data

Norway's Data Protection Authority fined Microsoft-owned advertising company Xandr $9.6M (NOK 92 million) for unlawfully processing and sharing sensitive Grindr user data. The authority said Xandr's advertising auctions between July 2018 and April 2020 potentially exposed information, including sexual orientation, to thousands of companies. Advertisers received profiling information before bidding to display ads. The authority found that Xandr, jointly responsible with Grindr for the processing, assumed Grindr had obtained valid consent without verifying it. Xandr has three weeks to appeal. Microsoft said the conduct predates its acquisition of Xandr and that it is reviewing the decision and assessing its options.