Norwegian authorities have levied a fine of 9.6 million dollars against Xandr, a company owned by Microsoft, for transmitting information that disclosed the sexual orientation of individuals using the Grindr application. The data transfers occurred as part of automated advertising auctions and took place between July 2018 and April 2020.
The case centers on the handling of sensitive personal details collected from users of the dating platform aimed at the LGBTQIA+ community. Xandr passed this information onward to other firms participating in real-time bidding processes for digital advertisements. Such practices raised concerns about the protection of private attributes during commercial data exchanges.
Officials determined that the sharing violated applicable rules on the processing of special categories of personal data. The period under review spans nearly two years, during which multiple instances of data relay were identified. The penalty reflects the seriousness with which regulators view unauthorized disclosure of orientation-related information.
Microsoft acquired Xandr in 2018, integrating the advertising technology platform into its broader portfolio. The fine represents one of several regulatory actions taken against data brokers and ad tech providers in recent years across Europe. Authorities emphasized the need for stricter controls when dealing with information that could reveal intimate aspects of users’ lives.
Grindr has faced scrutiny in the past over its data practices, prompting changes in how the service manages user profiles. In this instance, the focus rested on the intermediary role played by Xandr in distributing the data to third parties. The automated nature of the auctions meant that details were shared rapidly and at scale without adequate safeguards.
The decision underscores ongoing efforts by European regulators to enforce data protection standards in the digital advertising sector. Companies involved in programmatic advertising must ensure that sensitive attributes are not exposed during bidding processes. Failure to implement proper filtering mechanisms can result in substantial financial penalties.
Stakeholders in the technology and advertising industries are expected to review their data handling procedures in light of this ruling. The case illustrates the risks associated with aggregating and monetizing user information from niche platforms. Compliance teams at similar firms may now prioritize additional audits of data flows involving protected characteristics.
No appeals or further details on corrective measures have been disclosed at this stage. The fine amount aligns with precedents set in comparable privacy enforcement actions within the region. Observers note that such penalties serve as deterrents against lax handling of personal data in commercial ecosystems.
The incident highlights the intersection of advertising technology and privacy regulations. As digital platforms continue to expand, the transmission of user attributes through multiple intermediaries remains a focal point for oversight bodies. Future developments in this area may include updated guidelines for ad tech participants.
Overall, the ruling reinforces the principle that companies must obtain explicit consent or meet strict necessity tests before processing or sharing data that reveals sexual orientation. The Norwegian decision adds to a growing body of case law addressing similar issues in automated marketing environments.
