Privacy win: Norwegian Authority fines Microsoft’s Xandr € 8.5 Million
Norwegian Authority fines Microsoft's Xandr €8.5M for GDPR violations related to Grindr data.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Norwegian Data Protection Authority has fined Microsoft's Xandr €8.5 million for violating GDPR by processing personal data, including sensitive information on sexual orientation, without a valid legal basis. The complaint stemmed from Xandr's processing of data from the dating app Grindr, highlighting a significant blow to the online adtech industry's tracking and profiling practices. This decision underscores the need for valid consent in data processing and comes amidst ongoing lobbying efforts to potentially alter GDPR's scope regarding online tracking IDs.
The lesson from this incident
Full lessonMicrosoft's Xandr processed highly sensitive personal data — including information on sexual orientation sourced from the Grindr dating app — without a valid legal basis, violating GDPR's core principles around lawful processing and special category data. The root cause is a failure to establish and verify proper consent mechanisms before ingesting and profiling user data from third-party sources. This case illustrates how the adtech industry's opaque data-sharing ecosystems can expose organizations to massive regulatory penalties. It also highlights that receiving data from a third party does not absolve a company of its own GDPR obligations as a data controller or processor.
What helps against this
How we list vendors
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.