[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2H_x4wSrSh11M18r2R6laYOTPNTEiJxPTQZ4UHE1-mM":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"9805407c-3fff-4a07-a665-83cd8dfc217a","Norway fines Microsoft ad firm $9.6 million over Grindr data sharing","norway-fines-microsoft-ad-firm-9-6-million-over-grindr-data-sharing-1507a8","Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. [...]","Norway's Data Protection Authority has fined Microsoft-owned Xandr $9.6 million for unlawfully processing and sharing sensitive data of Grindr users. The ad firm, acting as an intermediary, exposed users' sexual orientation information to thousands of companies without verifying explicit consent between 2018 and 2020. This marks the largest fine ever issued by the authority, highlighting serious breaches of data privacy.","Norway fines Microsoft ad firm Xandr $9.6M for unlawful Grindr user data sharing.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnorway-fines-microsoft-ad-firm-96-million-over-grindr-data-sharing\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F25\u002F0_norway.jpg","2026-10-12T20:13:52+00:00","2026-10-12T22:00:17.806709+00:00",7,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Xandr","product",{"name":24,"type":22},"Grindr","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":25,"icon":27,"name":28,"slug":29},null,"Privacy Fines","privacy-fines",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21,24],{"controls":49,"vendors":121},[50,78,104],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,62,70],{"vendor_slug":56,"vendor_name":18,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":79,"name":80,"problem":81,"products":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[83,88,96],{"vendor_slug":56,"vendor_name":18,"vendor_logo":57,"product_slug":84,"product_name":85,"url":86,"description":87},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":105,"name":106,"problem":107,"products":108},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[109,115],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":110,"product_name":111,"url":113,"description":114},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[122],{"slug":56,"name":18,"logo_path":57,"roles":123},[124],"affected",{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":139},"xandr-fined-96m-for-unlawful-sharing-of-grindr-users-sensitive-data","Xandr Fined $9.6M for Unlawful Sharing of Grindr Users' Sensitive Data","Xandr, acting as an advertising intermediary, processed and distributed highly sensitive sexual orientation data from Grindr users to thousands of third-party companies without obtaining or verifying explicit user consent — a clear violation of GDPR principles. The root cause lies in a failure to implement proper data governance controls within the advertising supply chain, where sensitive personal data flowed freely without adequate legal basis. This case illustrates how ad-tech ecosystems can become vectors for massive privacy violations, often invisible to the individuals whose data is being exploited. The record fine signals that regulators will hold intermediaries — not just data originators — accountable for unlawful processing, raising the stakes for all participants in digital advertising pipelines.",[130,131,132,133,134,135,136,137,138],"GDPR Article 5 (Principles of data processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 9 (Processing of special categories of personal data)","GDPR Article 28 (Processor obligations)","NIST Privacy Framework PR.DS-P (Data processing ecosystem)","NIST SP 800-53 PT-1 (Privacy Policy and Procedures)","CIS Control 3 (Data Protection)","CIS Control 15 (Service Provider Management)","ISO 27701 Section 7.2 (Conditions for collection and processing)",{}]