Norway’s data protection authority, Datatilsynet, has fined Xandr, an advertising technology company now owned by Microsoft, NOK 92 million for passing personal data of Grindr users into automated ad auctions without a valid legal basis, the regulator announced Monday. The amount equals about $9.6 million, Reuters reported. The ruling makes a broader point for any company that buys or relays data from partners: relying on someone else’s consent is not enough.

It is the largest fine the authority has issued. Grindr is a location-based dating app for gay, bisexual, trans and queer people, so the regulator treated the data as revealing users’ sexual orientation, one of the specially protected categories under European privacy law.

What Happened

According to the decision, dated Oct. 2, Xandr processed at least three pieces of information about Grindr users in Norway: the fact that they used Grindr, their advertising IDs and their IP addresses. It did so through real-time bidding, the automated system behind much online advertising. Each time someone opens an app or web page with ad space, details about that person are sent out to advertising platforms, and advertisers bid in a fraction of a second for the chance to show them an ad. The user cannot see any of this.

RelatedFBI Warns Scammers Are Using AI to Impersonate Candidates Ahead of the Midterms

Xandr ran platforms on both sides of those auctions, for the apps selling ad space and for the advertisers buying it. The authority found it was a joint controller with Grindr, meaning it shared legal responsibility for how the data was used. Because the data was sensitive, explicit consent was required. Xandr did not collect consent itself and relied on consents gathered by Grindr, which were invalid. The authority concluded that Xandr broke Articles 6(1) and 9(1) of the General Data Protection Regulation (GDPR), the rules on lawful processing and on sensitive data.

Xandr argued that it believed Grindr had obtained consent. The regulator rejected that, writing that accountability cannot be outsourced and that each joint controller must verify for itself that consent is valid and covers its own processing. “Our key message is that responsibility for data protection cannot be passed on to others,” Director General Line Coll said in the announcement.

The conduct ran from July 2018 to April 2020. The authority said thousands of users in Norway were affected and that their data could have reached potentially thousands of companies.

Why It Matters

The decision extends liability along the advertising supply chain. Grindr was fined NOK 65 million in 2021 over the same practices, a penalty later upheld by Norway’s Privacy Appeals Board, the Oslo District Court and the Borgarting Court of Appeal. This time the regulator went after an intermediary. For ad exchanges, data brokers and any company ingesting partner data, contract clauses promising that consent was collected may not protect them; regulators may expect evidence that the receiving company checked.

The decision also shows how pre-acquisition conduct follows a company. AT&T bought Xandr’s predecessor, AppNexus, in 2018, and Microsoft acquired Xandr in June 2022, after the period under review. The regulator therefore set the fine against Xandr’s own revenue rather than Microsoft’s, which capped the legal maximum in this case at 20 million euros. Microsoft told Reuters the decision concerns conduct that predates its purchase and that “we are reviewing the decision and assessing our options.”

The authority counted the length of the violations and Xandr’s financial benefit as aggravating factors. It rejected the argument that the practice was common across the industry, and reduced the fine because the case took a long time to handle.

Context

Norway is not a member of the European Union, but it applies the GDPR through the European Economic Area, so its decisions draw on the same law that governs data use across the EU. The case began with complaints filed in 2020 by the Norwegian Consumer Council against Grindr, Xandr and four other ad-tech companies. The Austrian privacy group noyb, which backed the complaint, called the decision a precedent, Reuters reported.

What to Watch

Xandr has three weeks from receiving the decision to appeal. Under the decision, an appeal goes first to Datatilsynet and, if the authority stands by its ruling, to the Privacy Appeals Board. The regulator’s announcement does not say what has happened to the complaints against the other four ad-tech companies, which will show whether intermediaries across the industry face similar penalties.