Published · Norway
GDPRHigh severityEnforcement action
Norwegian data protection authority fines Microsoft’s Xandr € 8.5 million over unlawful processing
Norway’s regulator imposed an €8.5 million fine on Xandr for processing Grindr users’ sensitive data without a legal basis.
1 source · €8.5M penalty · Norwegian Data Protection Authority
What happened
- The Norwegian Data Protection Authority ruled that Xandr processed personal data from Grindr, including sexual orientation, without a valid legal basis. - The authority imposed a fine of €8.5 million (≈ NOK 92 million). - The case stemmed from a 2020 complaint by noyb and the Norwegian Consumer Council. - The decision is seen as a precedent for adtech firms handling tracking data.
Why it matters
Other adtech firms that rely on cross‑app tracking must reassess consent mechanisms and may face similar penalties if they lack a lawful basis.
Business impact
Companies will need to overhaul data‑sharing contracts and implement robust consent management, potentially increasing compliance costs and limiting profiling capabilities.
Drafted automatically from the sources below. How we write summaries
Does this summary seem wrong?What to check
audit consent practicesHigh priority
Review all tracking and profiling activities to confirm a valid legal basis under GDPR.
update data processing agreementsHigh priority
Ensure contracts with partners include GDPR‑compliant clauses for sensitive data.
implement granular consent UIMedium priority
Provide users clear options to opt‑in to tracking of sensitive categories such as sexual orientation.
Discussion
No comments yet. Start the discussion.