The Norwegian Data Protection Authority has imposed a €8.6 million fine on Xandr, the Microsoft-owned advertising technology unit, for illegally relaying Grindr users' sensitive data—including sexual orientation—to advertisers without valid consent. The penalty, the largest ever issued by the Norwegian DPA, underscores heightened enforcement of GDPR special category data protections within the ad-tech sector.

What should defenders do?

Xandr and Microsoft must cease the illegal data relay to advertisers, implement GDPR-compliant consent mechanisms for processing special category data, and undergo likely ongoing compliance audits. As this is a policy and procedural violation, no software patch is applicable. Affected users should review privacy settings within Grindr and associated platforms.

highPrivacy

Norwegian DPA Fines Xandr €8.6 Million for Illegally Relaying Grindr User Data

Largest penalty yet by Norwegian Data Protection Authority; violation involves special category data and GDPR consent failures

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Norwegian DPA Fines Xandr €8.6 Million for Illegally Relaying Grindr User Data

Key Takeaways

The Norwegian DPA fined Xandr €8.6 million for illegally sharing Grindr users' sensitive data with advertisers.
The violation involved special category data, specifically users' sexual orientation, processed without valid consent under GDPR.
This is the largest penalty ever issued by the Norwegian Data Protection Authority.

Related Security News

highMalware

Low-Cost Android Phones Ship With Preinstalled Malware Turning Devices Into Residential Proxies

Researchers from Bitdefender have uncovered malware preinstalled in the firmware of low-cost Android smartphones, enabling covert app installation, ad fraud, and the conscription of devices into residential proxy networks. The threat, tracked as Midnight Mimosa, targets devices built on MediaTek platforms and affects multiple brands. The malware activates automatically during initial device setup, requiring no further user interaction.

The Hacker Newsabout 10 hours ago1 min read