More than six years after a complaint was lodged against it, the advertising technology company Xandr has been ordered to pay 92 million Norwegian kroner, about $9.6 million, for relaying personal data about Grindr users to potentially thousands of advertising companies without a valid legal basis. Datatilsynet, the Norwegian data protection regulator, announced the decision on October 12. It is the largest fine the regulator has ever issued.
Xandr, formerly AppNexus, belongs to Microsoft and operates as Microsoft Advertising. The conduct at issue ran from July 2018 to April 2020, before the acquisition, and the regulator calculated the penalty on Xandr's own turnover rather than Microsoft's. Microsoft said the investigation concerned conduct that predates its ownership of the company, that legal frameworks and their enforcement have changed since, and that it was reviewing the decision and weighing its options. Xandr has three weeks from receiving the decision to appeal.
Auctions inside a dating app
Grindr is a dating app built around location for gay, bisexual, trans and queer users. Between 2018 and 2020 Xandr ran real time bidding auctions for the advertising space inside the app, acting on both the buying and the selling side. Datatilsynet found that each time a person opened Grindr, profiling data about that person was in many cases routed via Xandr to what may have been thousands of companies in the advertising chain, which then bid against one another for the right to show that person an ad.
Real time bidding is the plumbing behind most personalized advertising on the open web. A site or app with an ad slot sends information about the visitor to an advertising platform, which broadcasts it to prospective buyers; the buyers return bids, the highest wins, and the whole exchange is over in well under a second with no visible trace for the person whose data was shared. Datatilsynet treats it as a consent problem because the data leaves the publisher's hands before anyone can meaningfully agree to where it goes, and because the recipients are too numerous for a user to identify, let alone object to.
In Grindr's case the data carried extra weight. Datatilsynet's position, endorsed by the Borgarting Court of Appeal in the earlier proceedings against Grindr, is that simply being a user of the app reveals sexual orientation, a special category of data that the GDPR protects more strictly than ordinary personal information. Processing it for advertising requires explicit consent.
Consent that nobody checked
Xandr's defense was that it believed Grindr had collected consent from its users. The regulator rejected that outright. Its finding is that Xandr and Grindr were joint controllers, that Xandr's own processing needed explicit consent, and that the company did nothing to confirm that the consents passed along by Grindr were valid. Line Coll, the authority's director general, said that no company can hand its data protection obligations to another, and that each participant must itself be able to document a lawful basis for what it does with personal data.
Several factors pushed the amount to a record. Datatilsynet described Xandr as a large and leading player in a sector whose business model is built on processing personal data, noted that the company profited directly from the unlawful sharing, and counted the nearly two year duration of the infringement as aggravating. Grindr itself was fined 65 million kroner in 2021 for equivalent breaches.
A complaint from January 2020
The case began in January 2020, when the Norwegian Consumer Council, working with the Austrian privacy group noyb, filed complaints against Grindr and several advertising technology companies that received data from the app, Xandr among them. The complaints grew out of the council's research into how mobile apps broadcast personal data to the advertising industry. Felix Mikolasch, a data protection lawyer at noyb, said the outcome sets a precedent for similar cases against adtech firms that operate out of sight and are rarely held to account. Finn Myrstad, the council's director of digital policy, said it was hard to see how advertising built on tracking could be lawful at all if consent has to be genuinely informed.
The group also used the decision to warn about the European Commission's Digital Omnibus proposal, which in its reading would take online tracking identifiers out of the GDPR's scope and make cases of this kind impossible to bring. For the advertising industry the more immediate question is narrower: whether an intermediary that never sees a consent screen can keep assuming someone upstream obtained permission. Norway's regulator has answered that with the largest fine in its history.
