Online & Mobile tracking
In 2020,
noyb
(in cooperation with the Norwegian Consumer Council) has filed a complaint against the online advertising company Xandr
(now part of Microsoft) for processing personal data from the dating app Grindr. Now, the Norwegian Data Protection Authority has issued its decision – and fined Xandr € 8.5 million (NOK 92 000 000) for its GDPR violations. This decision is a major blow to the online adtech industry.
Press Release of the Norwegian Data Protection Authority
Original complaint
Online Advertising.
A lot of smartphone apps send highly personal data of their users to thousands of advertising partners via online tracking IDs.
A report by the Norwegian Consumer Council
(NCC) uncovered how every time we use apps on our phones, personal data about our interests, habits, and behavior is sent to a large number of “shadowy entities”. This information is used to create comprehensive profiles, which can then be used for targeted advertising and other purposes.
Three complaints
. In 2020, the NCC and
noyb
filed three GDPR complaints against the dating app Grindr and several adtech companies that received personal data through the app. One of these complaints concerned Xandr, an online advertising company that now belongs to Microsoft.
Xandr violated the law
. Now, the Norwegian Data Protection Authority has decided that Microsoft’s Xandr violated the GDPR. It processed personal data, including sensitive information on sexual orientation, without a valid legal basis. Xandr was ordered to pay a fine of roughly € 8.5 million Euros.
Felix Mikolasch, data protection lawyer at
noyb
: “
We very much welcome this decision. Online adtech companies such as Xandr often operate in the background and are rarely held accountable for their practices. This sets a valuable precedent for similar cases.
”
Blow for online adtech
. The decision is a major blow for the online advertising and commercial surveillance industry. Many websites
