Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
Xandr fined €8.6M for illegally relaying Grindr users' sensitive data.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Norwegian Data Protection Authority (DPA) has imposed a record €8.6 million fine on Xandr, a Microsoft-owned advertising unit. The penalty stems from Xandr illegally relaying sensitive Grindr user data, including sexual orientation, to advertisers. The DPA deemed the breach "very serious," warranting the largest administrative penalty ever issued by the watchdog.
The lesson from this incident
Full lessonXandr, a Microsoft-owned ad-tech platform, was found to have relayed highly sensitive personal data — specifically users' sexual orientation derived from Grindr — to third-party advertisers without a lawful basis under GDPR. This constitutes a critical failure in data minimization, purpose limitation, and third-party data handling controls. Sexual orientation is classified as a 'special category' of personal data under GDPR Article 9, requiring explicit consent and heightened protection. The case highlights how ad-tech supply chains routinely transmit sensitive inferences about individuals far beyond what users would reasonably expect, creating systemic privacy risks at scale.
What helps against this
How we list vendors
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.