Clarissa Hana
Norway’s Data Protection Authority (Datatilsynet) has imposed a significant financial penalty of NOK 92 million, equivalent to approximately $9.6 million USD, upon Xandr, an advertising technology company now under the umbrella of Microsoft. The penalty stems from Xandr’s alleged unlawful processing and sharing of sensitive personal data belonging to users of the popular dating application Grindr within Norway. This landmark decision marks the largest fine ever issued by the Norwegian data protection watchdog, underscoring the severity with which regulatory bodies are treating violations of data privacy laws, particularly concerning sensitive user information.
"We issued such a high fine in this case because the breaches we identified were very serious," stated Line Coll, Director General of Datatilsynet. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data." The authority’s investigation revealed that between July 2018 and April 2020, Xandr played a pivotal role in facilitating real-time advertising auctions within the Grindr app. In this capacity, Xandr acted as an intermediary, managing the complex bidding process where advertisers vied for the opportunity to display advertisements to Grindr users. This process, according to Datatilsynet, inherently involved the potential exposure of user data, including highly sensitive information about their sexual orientation, to a vast network of third-party companies.
The Mechanics of Ad Tech and Consent Failures
The functioning of real-time advertising auctions, as described by the authority, is crucial to understanding the alleged privacy violations. When a user opened Grindr, an auction would be triggered in milliseconds. Advertisers, through platforms like Xandr, would bid to show their ads. To make these bids relevant, advertisers would receive profiling information about the user, which could include demographic data, location, and inferred interests. In the context of Grindr, this profiling could inadvertently reveal deeply personal information about a user’s sexual orientation, a category of data that is afforded heightened protection under data privacy regulations like the General Data Protection Regulation (GDPR) which Norway adheres to.
At the time of the alleged infringements, Xandr operated as a joint controller with Grindr. This designation signifies that both entities shared responsibility for determining the purposes and means of processing user data. Consequently, Xandr was obligated to ensure that any data processing it undertook was based on a valid legal basis, which, for sensitive data, typically requires explicit and informed consent from the user. Grindr, a location-based dating application predominantly used by the LGBTQ+ community, handles a significant amount of sensitive personal information.
The core of Datatilsynet’s finding is that Xandr failed in its due diligence regarding user consent. The authority determined that Xandr proceeded under the assumption that Grindr had obtained valid consent from its users for the data sharing practices involved in the ad auctions. However, Xandr allegedly did not implement any robust mechanisms to verify the legitimacy or scope of these consents. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll elaborated, referencing the detailed findings published by the agency. This passive reliance on Grindr’s representations, without independent verification, is central to the authority’s conclusion that Xandr engaged in unlawful data processing.
Chronology of Events and the Complaint
The period under scrutiny, from July 2018 to April 2020, represents a critical phase in the evolution of data privacy regulations and enforcement, particularly following the GDPR’s implementation in May 2018. The GDPR significantly strengthened individuals’ rights over their personal data and imposed stricter obligations on data controllers and processors.
The complaint that initiated Datatilsynet’s investigation was lodged in January 2020. This complaint was filed by the Austrian non-profit privacy advocacy organization Noyb (None Of Your Business) in collaboration with the Norwegian Consumer Council (Forbrukerrådet). Noyb, known for its proactive approach to challenging privacy infringements by major tech companies, and the Forbrukerrådet, a prominent consumer rights organization in Norway, brought forth evidence suggesting widespread and potentially illegal data sharing practices involving Grindr and several third-party companies, including Xandr.
Their joint complaint highlighted concerns about the lack of transparency and explicit consent mechanisms for the sharing of sensitive user data within the ad tech ecosystem. The organizations argued that users were not adequately informed about the extent to which their data, including their sexual orientation and location, was being shared with numerous unknown entities for commercial purposes.
Supporting Data and Broader Implications
The scale of the data exposure, as suggested by Datatilsynet, is substantial. While specific numbers of affected Norwegian users were not detailed in the initial announcement, the authority’s statement that "thousands of users in Norway have been subjected to unlawful sharing of their sensitive data" indicates a significant impact within the country. Furthermore, the processing and sharing were not limited to Norwegian residents; sensitive information about Grindr users from other countries was also potentially exposed.
The implications of this fine extend far beyond Xandr and Grindr. The decision is being hailed by privacy advocates as a significant victory against the pervasive practices within the online advertising technology (adtech) industry. Max Schrems, founder of Noyb, commented on the ruling, stating, "The current fine shows that companies such as Xandr are eventually held accountable for their shady practices." He further emphasized the fundamental requirement for consent in such data-intensive operations: "Profiling people’s interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain."
This ruling reinforces the principle that companies operating within the adtech sphere cannot operate with impunity. The ability to collect, process, and share vast amounts of user data, often without clear and informed consent, has been a cornerstone of the digital advertising model. However, regulatory bodies are increasingly scrutinizing these practices, recognizing the potential for harm and the erosion of individual privacy. The decision by Datatilsynet signals a growing global trend of enhanced data protection enforcement.
The findings highlight a critical vulnerability in the adtech supply chain: the reliance on intermediaries to manage data flows and the subsequent lack of oversight regarding the validity of consent. When an app like Grindr shares user data with an ad tech platform like Xandr, and Xandr then facilitates the sharing of that data with potentially thousands of advertisers, the chain of accountability can become complex and opaque. This ruling emphasizes that each entity in this chain has a responsibility to ensure lawful data processing.
Official Responses and Future Outlook
Xandr, which now operates under the name Microsoft Advertising following Microsoft’s acquisition of its advertising business, has been given a three-week period to appeal Datatilsynet’s decision. A spokesperson for Microsoft stated that the investigation and its outcome "focused on conduct that predates Microsoft’s acquisition of Xandr." This suggests that Microsoft aims to distance the current corporate entity from the alleged violations that occurred under previous ownership. The spokesperson further noted that legal frameworks and their enforcement have evolved since the period in question, and that Microsoft is "reviewing the decision and assessing our options."
The Norwegian Data Protection Authority’s decision is consistent with a broader global push for stronger data privacy protections. Similar investigations and enforcement actions have been undertaken by regulatory bodies in the European Union and other jurisdictions. The GDPR, with its stringent requirements for consent, data minimization, and accountability, has set a high bar for data processing activities.
The ruling serves as a potent reminder for all companies involved in the collection, processing, and sharing of personal data, especially sensitive information. It underscores the necessity of:
- Robust Consent Mechanisms: Ensuring that consent is freely given, specific, informed, and unambiguous, and that users can easily withdraw it.
- Due Diligence: Actively verifying the legal basis for data processing, rather than relying on assumptions or representations from partners.
- Transparency: Clearly informing users about what data is collected, how it is used, and with whom it is shared.
- Accountability: Establishing clear lines of responsibility for data processing activities throughout the data supply chain.
The significant fine levied against Xandr by Datatilsynet is likely to reverberate throughout the adtech industry, potentially leading to a re-evaluation of data handling practices and a greater emphasis on privacy-by-design principles. As regulatory scrutiny intensifies and public awareness of data privacy issues grows, companies will face increasing pressure to demonstrate their commitment to protecting user data. The ultimate impact will be seen in how the industry adapts to these evolving legal and ethical expectations, and whether such significant penalties can foster a more privacy-conscious digital advertising landscape.
