Ethical Hacking News
Xandr, an advertising unit owned by Microsoft, has been fined €8.6 million ($9.62 million) by the Norwegian Data Protection Authority for illegally relaying Grindr users' sensitive data to advertisers. This significant fine serves as a stark reminder of the importance of data protection and the need for companies to prioritize their obligations to protect sensitive user information.
Xandr, an advertising unit owned by Microsoft, was fined €8.6 million ($9.62 million) by the Norwegian Data Protection Authority (DPA) for violating data privacy regulations. Xandr illicitly relayed sensitive data of Grindr users in Norway to potentially thousands of other companies, including information on users' sexual orientation. Xandr pointed fingers at Grindr, stating it assumed the online dating app had collected users' consent, instead of ensuring it had obtained the legal basis for its own processing of the data. The DPA found Xandr's actions constituted a serious breach of data protection regulations, and the company's failure to obtain users' consent was a clear violation of its obligations as a joint controller. The fine serves as a reminder of the importance of data protection and the need for companies to prioritize their obligations to protect sensitive user information.
The Norwegian Data Protection Authority (DPA) has recently levied a substantial fine of €8.6 million ($9.62 million) against Xandr, an advertising unit owned by Microsoft, for its egregious breach of data privacy regulations. This penalty serves as a stark reminder of the severe consequences that companies can face when they fail to adhere to the principles of data protection, and the importance of ensuring that personal data is handled with the utmost care and respect.
Xandr, which was formed by AT&T following its acquisition of AppNexus in June 2018, was found to have illicitly relayed the sensitive data of Grindr users in Norway to potentially thousands of other companies. The data in question included information revealing the sexual orientation of the users, which is a particularly sensitive and personal aspect of an individual's identity. This breach of trust was made all the more egregious by the fact that Xandr, as a joint controller with Grindr, was responsible for obtaining users' consent before processing their data.
Instead of ensuring that it had obtained the legal basis for its own processing of the data, Xandr pointed fingers at Grindr, stating that it assumed the online dating app had collected users' consent to do so. This brazen lack of accountability and transparency is a stark example of the kind of recklessness and disregard for data protection that can occur when companies prioritize their commercial interests over their obligations to protect sensitive user information.
The investigation conducted by the Norwegian DPA found that Xandr's actions constituted a serious breach of data protection regulations, and that the company's failure to ensure that it had obtained users' consent before processing their data was a clear violation of its obligations as a joint controller. The DPA's decision to fine Xandr €8.6 million ($9.62 million) was seen as a necessary measure to hold the company accountable for its actions, and to deter other companies from engaging in similar practices.
This case serves as a stark reminder of the importance of data protection and the need for companies to prioritize their obligations to protect sensitive user information. The DPA's decision to fine Xandr is a significant development in the ongoing effort to hold companies accountable for their actions, and to ensure that they are taking steps to protect the personal data of their users.
In addition to the fine levied against Xandr, the case also highlights the importance of cooperation and accountability between companies and regulatory bodies. The fact that Xandr was found to have acted as an intermediary that relayed personal data to potentially thousands of other companies is a stark example of the kind of complex and interconnected nature of modern data exchange, and the need for companies to work together to ensure that they are all taking steps to protect sensitive user information.
The case also raises important questions about the role of regulatory bodies in ensuring that companies are taking steps to protect sensitive user information. The Norwegian DPA's decision to fine Xandr €8.6 million ($9.62 million) serves as a clear example of the kind of regulatory oversight that is necessary to ensure that companies are taking steps to protect the personal data of their users.
Furthermore, the case highlights the importance of data protection in the digital age, and the need for companies to prioritize their obligations to protect sensitive user information. The fact that Xandr's actions constituted a serious breach of data protection regulations is a stark reminder of the importance of taking steps to protect the personal data of users, and of the need for companies to be transparent and accountable in their handling of sensitive user information.
In conclusion, the case of Xandr highlights the importance of data protection and the need for companies to prioritize their obligations to protect sensitive user information. The Norwegian DPA's decision to fine Xandr €8.6 million ($9.62 million) serves as a clear example of the kind of regulatory oversight that is necessary to ensure that companies are taking steps to protect the personal data of their users.
Related Information:
https://www.ethicalhackingnews.com/articles/Xandr-Fined-Record-86-Million-for-Illicit-Data-Relaying-to-Advertisers-ehn.shtml
https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html
https://cyberinsider.com/microsofts-xandr-fined-e8-6m-over-grindr-user-data-exposure/
Published: Tue Oct 13 11:50:21 2026 by llama3.2 3B Q4_K_M
