Norway's Data Protection Authority (DPA) has imposed a substantial €8.6 million ($9.62 million) fine on **Xandr**, an advertising technology firm now under the **Microsoft** umbrella. The penalty stems from **Xandr**'s illegal sharing of sensitive user data from the dating application **Grindr** with advertisers. ### Record-Breaking Fine for Data Privacy Breach The administrative penalty marks the most significant fine ever issued by the Norwegian DPA, citing the "very serious" nature of the infringement. The unlawful data relaying occurred between July 2018 and April 2020. "**Xandr** acted as an intermediary that relayed the personal data of **Grindr** users in Norway, including data revealing sexual orientation, to potentially thousands of other companies," the DPA stated. ### Joint Controller Responsibility Ignored The DPA's investigation concluded that **Xandr** was a joint controller with **Grindr**, meaning it shared responsibility for obtaining explicit user consent before processing their data. Instead of ensuring this legal basis, **Xandr** reportedly shifted blame to **Grindr**, assuming the dating app had secured the necessary consent. ### The Evolution of Xandr **Xandr** was initially formed by **AT&T** following its June 2018 acquisition of **AppNexus**. The brand's name is a tribute to Alexander Graham Bell, **AT&T**'s founder. **Microsoft** later acquired **Xandr** in late December 2021, eventually consolidating its operations under the **Microsoft Ads** umbrella by June 2023. ### Origins of the Complaint The case originated in 2020 when the Norwegian Consumer Council, in collaboration with the Austrian privacy non-profit **None of Your Business (noyb)**, filed a complaint against **Xandr**. They accused the company of unlawfully sharing users' personal data for commercial purposes without explicit consent, impacting thousands of Norwegian users. ### Real-Time Bidding and Hidden Data Sharing "The essence of the infringement was **Xandr**'s participation in so-called real-time bidding, where they acted both on the buyer and seller side," the watchdog explained. "When a person opened **Grindr**, their personal data was in many cases relayed through **Xandr** to potentially thousands of actors in the advertising ecosystem." This allowed advertisers to bid on targeted ads, often without the user's knowledge. ### Fine Calculation and Appeal The DPA calculated the fine based on **Xandr**'s total annual turnover during the two-year infringement period, which predates **Microsoft**'s acquisition. **Xandr** has three weeks to appeal the decision. **Noyb** hailed the fine as a "major blow for the online advertising and commercial surveillance industry," asserting that "companies such as **Xandr** are eventually held accountable for their shady practices." **Microsoft** has indicated it is reviewing the decision and assessing its options. ### Broader Context of Data Privacy Enforcement This development follows **Grindr**'s recent agreement to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. concerning allegations of sharing users' personal information, including HIV status, with third parties. These cases highlight a growing global trend of increased scrutiny and enforcement against companies for privacy infringements. In related news, a Texas federal judge recently granted final approval for a $177 million **AT&T** settlement. This settlement addresses two separate data breaches in March and July 2024 that exposed the personal information of **AT&T** consumers. The March 2024 incident involved a dark web dataset containing Social Security numbers, affecting 7.6 million current and 65.4 million former **AT&T** account holders. The July 2024 breach saw threat actors illegally download customer data from a third-party cloud platform hosted by **Snowflake**, compromising call and text message records for nearly all cellular customers between May 1 and October 31, 2022.