In 2020, noyb (in cooperation with the Norwegian Consumer Council) has filed a complaint against the online advertising company Xandr (now part of Microsoft) for processing personal data from the dating app Grindr. Now, the Norwegian Data Protection Authority has issued its decision – and fined Xandr € 8.5 million (NOK 92 000 000) for its GDPR violations. This decision is a major blow to the online adtech industry.
Online Advertising. A lot of smartphone apps send highly personal data of their users to thousands of advertising partners via online tracking IDs. A report by the Norwegian Consumer Council (NCC) uncovered how every time we use apps on our phones, personal data about our interests, habits, and behavior is sent to a large number of “shadowy entities”. This information is used to create comprehensive profiles, which can then be used for targeted advertising and other purposes.
Three complaints. In 2020, the NCC and noyb filed three GDPR complaints against the dating app Grindr and several adtech companies that received personal data through the app. One of these complaints concerned Xandr, an online advertising company that now belongs to Microsoft.
Xandr violated the law. Now, the Norwegian Data Protection Authority has decided that Microsoft’s Xandr violated the GDPR. It processed personal data, including sensitive information on sexual orientation, without a valid legal basis. Xandr was ordered to pay a fine of roughly € 8.5 million Euros.
Felix Mikolasch, data protection lawyer at noyb: “We very much welcome this decision. Online adtech companies such as Xandr often operate in the background and are rarely held accountable for their practices. This sets a valuable precedent for similar cases.”
Blow for online adtech. The decision is a major blow for the online advertising and commercial surveillance industry. Many websites, apps, platforms, operating systems and others send user data to adtech companies. These companies profile users and accumulate huge amounts of personal data, which is shared between thousands of companies for advertising and other purposes. The current fine shows that companies such as Xandr are eventually held accountable for their shady practices. Profiling people’s interests, habits, location and behavior requires valid consent – which adtech companies hardly ever obtain.
Finn Myrstad, Director of Digital Policy at the Norwegian Consumer Council: “This sends a powerful signal to everyone whose business model depends on tracking and profiling consumers. If consent is to be genuinely informed and meaningful, it is hard to see how today’s surveillance-based advertising can be lawful at all.”
Big tech is lobbying hard. Meanwhile, the European Commission wants to change the GDPR via the so-called Digital Omnibus. Big tech has been lobbying hard to have the law changed so that online tracking IDs do no longer fall within the scope of the GDPR – and the EU Commission has cracked under their pressure. As a consequence, shady online advertising businesses and their highly problematic mass profiling of users could be unleashed. Companies such as Microsoft’s Xandr, Google, Meta, Apple, Amazon, Criteo, Grindr and others could then no longer be held accountable for breaches with these online tracking IDs. This EU Commission proposal is currently discussed by the European Parliament and Council.
