Overview
Norway’s Data Protection Authority, Datatilsynet, has fined Xandr, a Microsoft-owned advertising company, $9.6 million (NOK 92 million) for unlawfully processing and sharing sensitive personal data associated with Grindr users. The penalty is the largest fine Datatilsynet has issued to date and highlights a fundamental problem within modern advertising technology: data can move through highly automated ecosystems faster than organisations can establish whether that processing is actually lawful. The case relates to activity between July 2018 and April 2020, when Xandr operated real-time advertising auctions within Grindr. During this process, profiling information could potentially be exposed to thousands of companies participating in advertising auctions.
Sensitive Data Can Become an Advertising Signal
Grindr is a location-based dating application primarily serving the LGBTQ+ community. Consequently, information associated with its users can reveal highly sensitive characteristics, including sexual orientation. According to Datatilsynet, Xandr acted as a joint controller with Grindr during the relevant period. This meant Xandr had responsibilities concerning how the personal data was processed and required a valid legal basis for its own processing. The authority found that Xandr relied on the assumption that Grindr had obtained appropriate consent from users but did not independently verify whether that consent was valid. That distinction is critical. Trusting another organisation’s consent process does not automatically transfer responsibility for the subsequent processing of personal data.
The Data Supply Chain Is Part of the Security Boundary
Real-time advertising relies on complex data flows. A user interacts with an application, information is passed to an advertising intermediary, advertisers receive profiling information, and automated bidding determines which advertisement is displayed. From an infrastructure perspective, this can look like a highly efficient distributed system. From a privacy perspective, every additional participant represents another processing relationship, another access path and another point at which governance must remain intact. The Xandr case demonstrates that data protection cannot stop at the application boundary. The complete data lifecycle matters — collection, consent, processing, sharing, profiling and onward access.
Consent Cannot Be Treated as a Checkbox
One of the strongest lessons from the decision is the difference between recording a consent signal and establishing valid consent. If one organisation collects consent and another organisation subsequently processes the resulting data, the second organisation cannot necessarily assume that the original consent covers its own activities. This becomes particularly important when sensitive information is involved. Automated platforms can make data sharing appear almost invisible. There may be no obvious manual transfer, no email attachment and no administrator deliberately exporting a database. Instead, APIs, bidding platforms and automated processing engines move information continuously. The absence of human intervention does not remove the responsibility for controlling that data.
Privacy Governance Needs Technical Enforcement
The case also highlights the relationship between privacy governance and technology architecture. Data classification should determine where information can travel, which systems can process it and what third parties can receive it. Consent should be represented as an enforceable control rather than merely a policy statement. Third-party integrations should therefore be evaluated according to the data they can access, the purpose for which they process it and whether the appropriate legal basis exists for that processing. The principle is similar to security architecture: a trusted integration should never become an unrestricted data pathway.
Expert in the Cloud Insight
The Xandr decision demonstrates that data privacy failures do not necessarily require a cyberattack, malware or stolen credentials. A system can operate exactly as designed and still create a major privacy violation if the governance surrounding that system is inadequate. Microsoft has stated that the investigation concerns conduct predating its acquisition of Xandr and that it is reviewing the decision and considering its options. The broader lesson extends beyond any single company. Consent must follow the data throughout its lifecycle, not simply exist at the point where the data was originally collected. In an increasingly connected digital ecosystem, organisations need to know not only what data they hold, but who can access it, why they can access it, what legal basis permits that access, and where the data goes next. Privacy is therefore not simply a compliance function. It is an architectural control.
Leave a Reply