The Norwegian Data Protection Authority (NDPA) has fined Xandr, an adtech subsidiary of Microsoft, 92 million Norwegian kroner (approximately $9.6 million) for allegedly misusing Grindr user data. The NDPA charged that Xandr failed to obtain explicit consent to use sensitive personal data from Grindr users for targeted advertising, instead assuming the dating app had already secured approval. This represents the highest fine the Norwegian authority has issued to date.
According to the NDPA, when users opened Grindr, their personal data was relayed through Xandr to potentially thousands of advertising actors, enabling hidden targeted ad bidding. The case originated from a 2020 complaint by Norway's consumer council, covering data infringements between July 2018 and April 2020. The fine was calculated based on Xandr's total annual turnover.
Grindr has faced similar penalties previously, including a 5.6 million euro fine (about $6.2 million) from the same agency and a 2024 London lawsuit alleging sharing of HIV status and test dates.
Source: Engadget · Summarized by HeadlinesBriefing