Grindr User Data Shared Without Consent by Ad Tech Firm Xandr

Norway's privacy regulator, Datatilsynet, has imposed a significant fine of 92 million Norwegian kroner (approximately $9.6 million) on advertising technology company Xandr. The penalty stems from the unlawful processing and sharing of sensitive data pertaining to Grindr users, a practice that occurred between July 2018 and April 2020.

While the decision specifically addresses users within Norway, the scope of the data-sharing practices extended beyond the country's borders. Reports indicate that information about Grindr users in other regions was also exposed through Xandr's real-time advertising auctions. These auctions, designed for advertisers to bid on ad placements, inadvertently circulated user data, potentially exposing sensitive details about sexual orientation to thousands of companies.

Crucially, the data in question was not explicitly provided by users in their Grindr profiles. Datatilsynet determined that the mere identification of a user as being on Grindr was sufficient information to indicate their sexual orientation. This sensitive inference was then processed and shared without the necessary legal basis.

Xandr's defense relied on Grindr's consent mechanisms, but the Norwegian regulator found this insufficient. Datatilsynet stated that Xandr, as a jointly responsible party for data processing, had an obligation to verify the validity of the consent obtained by Grindr. Simply assuming that the app had secured the required explicit consent was not enough to meet regulatory requirements.

This incident is distinct from a typical data breach where hackers infiltrate systems. Instead, the sensitive information flowed through legitimate advertising channels due to a lack of valid consent. Privacy advocacy group noyb, which filed the complaint alongside the Norwegian Consumer Council, highlighted that such systems often build detailed user profiles using tracking identifiers to map interests, habits, and behaviors.

It is important to note that Xandr's misconduct predates its acquisition by Microsoft. Microsoft completed the purchase of Xandr from AT&T in June 2022, more than two years after the period covered by the fine. Microsoft has stated it is reviewing the decision and considering its options.

The implications of this ruling extend beyond Norway. Users in the United States and other regions should be aware that their data may have been similarly exposed. To mitigate such risks, users can limit the personal information shared with dating apps, leaving optional fields blank and avoiding the disclosure of sensitive details like workplace or home address. Reviewing app permissions and advertising settings can also help reduce data exposure.

Ultimately, the responsibility for unlawful data sharing lies with the companies involved. This case underscores that sensitive personal information can be inferred and shared simply from the use of a service, not just from explicit profile content. The fine serves as a stark reminder of the privacy risks inherent in the digital advertising ecosystem.

The Norwegian Data Protection Authority (DPA) has levied a record €8.6 million fine against Microsoft-owned Xandr for its role in illegally relaying sensitive Grindr user data, including sexual orientation, to advertisers. This penalty, deemed 'very serious' by the DPA, covers infringements between July 2018 and April 2020, predating Xandr's acquisition by Microsoft. The authority found Xandr acted as a joint controller with Grindr and was responsible for obtaining user consent, a responsibility it failed to meet by pointing fingers at the dating app.