Xandr Fined Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
Norwegian DPA fines Xandr €8.6M for relaying Grindr users' sensitive data to advertisers. Xandr was a joint controller with Grindr, but failed to ensure users' consent for data processing.
Intelligence analysis by Qwen 2.5 (3B)
Norwegian data protection authority fines Xandr €8.6M for illegally relaying Grindr users' sensitive data to advertisers, citing serious breach and lack of proper consent.
A company called Xandr was fined a lot of money by a group that makes rules about how people use personal information. Xandr was supposed to get people's permission to use their information, but they didn't. They used a dating app called Grindr to get people's information, but they said the app already had permission. This is a big deal because the information was about people's private stuff, like their sexual preferences.
Analysis
{"heading_1":"The Fine and Its Impact","subheading_1":"Background and Context","content_1":"Xandr, an advertising unit owned by Microsoft, was fined €8.6 million by the Norwegian Data Protection Authority (DPA) for illegally relaying Grindr users' sensitive data to advertisers. The fine is the largest issued by the DPA.","subheading_2":"The Breach and Its Details","content_2":"The infringement occurred between July 2018 and April 2020. Xandr acted as an intermediary that relayed Grindr users' personal data, including data revealing sexual orientation, to potentially thousands of other companies.","subheading_3":"The Role of Xandr and Grindr","content_3":"Xandr was a joint controller with Grindr, meaning it was responsible for obtaining users' consent before processing their data. Instead of ensuring they had the legal basis for their own processing of the data, Xandr pointed fingers at Grindr, claiming it assumed the online dating app had collected users' consent to do so.","subheading_4":"The Regulatory Response","content_4":"The DPA found Xandr's participation in real-time bidding, where they acted both on the buyer and seller side, to be the essence of the infringement. The fine was calculated based on Xandr's total annual turnover during the two-year time period, which predates Microsoft's acquisition.","subheading_5":"The Future of Xandr and Grindr","content_5":"Xandr has three weeks to appeal the decision. The fine is seen as a major blow for the online advertising and commercial surveillance industry, and companies like Xandr are eventually held accountable for their shady practices."}
Key points
- Xandr fined €8.6M by Norwegian DPA for relaying Grindr users' sensitive data to advertisers
- Xandr was a joint controller with Grindr, but failed to ensure users' consent for data processing
- The fine is the largest issued by the DPA
- Xandr has three weeks to appeal the decision
- The fine is seen as a major blow for the online advertising and commercial surveillance industry
The fine may encourage other companies to be more careful about how they use people's personal information and get permission.
This fine could set a bad example for other companies, making it harder to hold them accountable for using people's personal information without permission.
