Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data
Xandr, a Microsoft-owned ad-tech platform, was found to have relayed highly sensitive personal data — specifically users' sexual orientation derived from Grindr — to third-party advertisers without a lawful basis under GDPR. This constitutes a critical failure in data minimization, purpose limitation, and third-party data handling controls. Sexual orientation is classified as a 'special category' of personal data under GDPR Article 9, requiring explicit consent and heightened protection. The case highlights how ad-tech supply chains routinely transmit sensitive inferences about individuals far beyond what users would reasonably expect, creating systemic privacy risks at scale.
Tactical Insight
Immediate actions
- Audit all data flows involving third-party advertising partners to identify and halt transmission of special-category personal data.
- Implement data classification tagging so that sensitive attributes (e.g., health, sexual orientation, religion) are automatically flagged and blocked from ad-tech pipelines.
Long-term improvements
- Enforce data minimization and purpose limitation policies by design, ensuring ad platforms only receive anonymized, aggregated, and strictly necessary data.
- Establish a formal Third-Party Data Processing Agreement (DPA) review program to vet all advertising and analytics vendors for GDPR compliance before onboarding.
- Build a Data Protection Impact Assessment (DPIA) process triggered automatically whenever special-category data may enter a new processing pipeline.
Detection & Compliance measures
- Deploy continuous data flow monitoring tools to detect unauthorized transmission of sensitive personal data to external partners.
- Assign a Data Protection Officer (DPO) with authority to halt data-sharing arrangements that lack a valid legal basis under GDPR Articles 6 and 9.