Norway's biggest ever privacy fine went to an ad company you have never heard of

Norway's data protection authority handed down the largest fine in its history on 12 October. It went to Xandr, an advertising business now folded into Microsoft Advertising, for 92 million kroner, about 9.6 million dollars.

The conduct dates from July 2018 to April 2020. Xandr ran the advertising auctions inside the dating app Grindr, and in doing so passed user data into real-time bidding, where it could be seen by thousands of companies. Because of what the app is, that data carried an obvious implication about each user's sexual orientation, which European law treats as a special category requiring explicit consent. Xandr's defence was that it assumed Grindr had collected that consent. Datatilsynet rejected it, ruling that Xandr was a joint controller and carried its own share of the responsibility. The original complaint was filed by the privacy group noyb back in 2020. Microsoft points out the behaviour predates its purchase of the company and says it is reviewing the decision. It has three weeks to appeal.

Real-time bidding is worth understanding, because almost nobody has had it explained to them. Each time an ad slot loads in an app or a web page, a description of the person about to see it goes out to potential bidders and an auction settles in a fraction of a second. One advertiser wins. Everyone who lost still received the description, and nothing obliges them to throw it away.

You cannot opt out of that system in any complete sense, but you can reduce what feeds it: reset the advertising identifier on your phone, turn off personalised ads in your Google and Microsoft accounts, and take away location and contacts permissions from apps that have no business holding them. Tendvane's privacy and accounts check walks through the equivalent settings on your PC and shows which ones are currently working against you.