What happened
Norway's data protection authority, Datatilsynet, has fined the advertising company Xandr 92 million Norwegian kroner, around 9.6 million US dollars, for unlawfully processing and sharing sensitive data belonging to Grindr users in Norway. The regulator said it is the largest fine it has ever issued.
Between July 2018 and April 2020, Xandr ran real-time advertising auctions inside Grindr. Advertisers bid for the right to display an ad to a user after receiving profiling information from Xandr, which acted as the intermediary for those auctions. The authority found this potentially exposed sensitive information, including sexual orientation, to thousands of companies.
Xandr was a joint controller with Grindr during that period, which meant it shared responsibility for how the data was used and should have required and obtained explicit consent from the people concerned. According to the authority, Xandr assumed Grindr had collected valid consent but took no action to verify it, and did nothing to establish a legal basis for its own processing.
Line Coll, Director General of Datatilsynet, said the fine was high because the breaches identified were very serious, and that thousands of users in Norway had been subjected to unlawful sharing of their sensitive data.
The Austrian privacy organisation Noyb, which filed the original complaint in January 2020 together with the Norwegian Consumer Council, welcomed the decision and called it a major blow to the online advertising technology industry. Xandr, which now operates as Microsoft Advertising, was given three weeks to appeal. Microsoft said the investigation and outcome focused on conduct predating its acquisition of Xandr, that legal frameworks and their interpretation have changed since, and that the company is reviewing the decision.
Why this is a GRC story
Joint controllership is an obligation, not a label. The decision turns on a failure to verify someone else's legal basis before building a commercial process on top of it. Every organisation that receives personal data from a partner or a publisher faces the same question: what evidence did you check, and when.
Sensitive categories carry a far higher bar. Data revealing sexual orientation is a special category, so ordinary consent practices are not enough. Systems designed around inferred interests need re-examination when those inferences can reveal a protected characteristic.
Programmatic pipelines concentrate risk. Data passed through an auction reaches an unknown number of parties in milliseconds, and the controller in the middle may not be able to say where it went. That is a data mapping and disclosure problem as much as a legal one.
What to watch
Watch whether the appeal proceeds, and whether other European authorities apply the same logic to intermediaries in advertising and analytics. Enforcement aimed at the middle of the chain, rather than only the publisher, is what changes vendor behaviour.
For teams reviewing advertising and analytics vendors, the useful question is whether consent evidence is inspected rather than assumed, and whether records show what data left the organisation, to whom, and on what basis.
Attribution: Analysis based on BleepingComputer and related public reporting. This article is original commentary, not a repost of the source material.