The Norwegian Data Protection Authority (Datatilsynet) has concluded an investigation into Xandr, the advertising technology subsidiary acquired by Microsoft in 2022. The case centers on the unlawful processing and sharing of sensitive user data from the Grindr dating app between July 2018 and April 2020.
The case originated from a 2020 complaint filed by the Norwegian Consumer Council and the privacy advocacy group noyb. The investigation scrutinized how Xandr processed sensitive information—including location data and the fact that individuals used a dating app specifically for the LGBTQ+ community—to facilitate real-time bidding for advertisements.
Liability for Pre-Acquisition Activities
Although Microsoft acquired Xandr from AT&T in 2022, the violations occurred under previous ownership. This distinction acknowledges that the infractions took place before the acquisition while still holding the subsidiary accountable for its legacy data practices.
The regulatory action follows a related case where Grindr was fined 65 million NOK by Datatilsynet for its own privacy failures. That penalty was part of a broader crackdown on the programmatic advertising chain, which frequently involves broadcasting user data to hundreds of potential advertisers in milliseconds without explicit, informed consent.
Allegations of Record Deletion
The 54-page decision from Datatilsynet includes reports that Xandr deleted specific records while the regulatory investigation was already underway. Datatilsynet’s stance reinforces that ad exchanges cannot ignore the sensitive nature of the data they handle, even if they are not the primary point of collection for the user.
The regulatory action is expected to have a ripple effect across the adtech industry. It challenges the “real-time bidding” model by requiring intermediaries to have robust, verifiable methods of confirming consent before any sensitive data is auctioned or shared.
