The Norwegian Data Protection Authority has fined Microsoft's adtech unit, Xandr, 92 million kroner (approx. $9.6 million) for illegally sharing sensitive user data between 2018 and 2020. The ruling marks a significant legal precedent, holding adtech intermediaries directly responsible for data compliance. While the violations occurred before Microsoft acquired the company, the case highlights growing regulatory pressure on ad-tech firms to independently verify user consent processes.
The Norwegian Data Protection Authority has imposed a record fine of 92 million Norwegian kroner, or approximately $9.6 million, on Xandr, a digital advertising technology unit now owned by Microsoft. The penalty follows an investigation into automated advertising auctions conducted between July 2018 and April 2020. During this period, sensitive personal information, including data that could reveal the sexual orientation of users on the app Grindr, was shared with third-party advertisers without valid consent.
The regulator's decision is particularly significant because it challenges the standard defense often used by advertising technology companies. Xandr had argued that it was not responsible for the data breach because it relied on the Grindr application to ensure that users had provided the necessary consent. The Norwegian authority rejected this argument, establishing a firm legal precedent that companies acting as intermediaries in the digital advertising chain cannot outsource their legal compliance responsibilities. By ruling that intermediaries share concurrent liability for data mismanagement, the regulator has increased the potential legal and operational burden on firms that process and trade user data.
For investors, this case highlights a broader risk within the ad-tech and digital advertising sector. Privacy regulations, such as the GDPR in Europe, are becoming increasingly stringent regarding how data is collected, processed, and shared. As regulators focus more on the entire chain of data handling, companies may face higher compliance costs and the need for more rigorous, independent auditing of the data lineage they receive from partners. This shift toward stricter accountability could impact operational efficiency and margins for companies that rely heavily on automated ad auctions.
It is important to note that Microsoft acquired Xandr in 2022, well after the period of the recorded violations. In response to the fine, the technology giant noted that the behavior in question occurred prior to its ownership of the business. While the fine itself is immaterial to Microsoft’s massive global financial position, the regulatory scrutiny underscores the risks associated with acquiring ad-tech firms that may have legacy liabilities or questionable historical data practices.
This is not the first time regulators have acted in this matter. In 2021, the Norwegian authority issued a 65 million crown fine against Grindr itself regarding the same security failures. The case originated from complaints filed by the Norwegian Consumer Council and the advocacy group noyb. Xandr has three weeks from the date of the decision to appeal the ruling. Investors should monitor how the company chooses to proceed with the legal appeal and whether this regulatory precedent leads to similar enforcement actions against other ad-tech intermediaries across Europe.