Norway's data protection authority, Datatilsynet, fined the ad company Xandr 92 million Norwegian kroner, about €8.6 million. BleepingComputer put it at $9.6 million. The authority said it is its largest fine so far. It found that from July 2018 to April 2020, Xandr passed data on Grindr users in Norway to potentially thousands of firms. Grindr is a dating app, and the data included details pointing to sexual orientation. This happened through real-time bidding, where advertisers bid in automatic auctions to show an ad to one person.
The authority said Xandr assumed Grindr had gathered valid consent and never checked. It ruled that explicit consent was needed and that Xandr shared responsibility with Grindr. Xandr, now owned by Microsoft, has three weeks to appeal. Microsoft told BleepingComputer the case covered conduct from before it bought Xandr, and that it is reviewing the decision. The sources do not say whether Xandr will appeal, or give an exact number of affected users.
Datatilsynet said each company must ensure, and be able to show, that it handles personal data lawfully. Blaming a partner does not move that duty. Teams that run or buy ad tech should check consent themselves.