On 12 October, the Norwegian Data Protection Authority fined advertising company Xandr €8.6m for unlawfully sharing personal data with potentially thousands of companies. 

The decision follows an investigation based on findings from BEUC member Forbrukerrådet, the Norwegian Consumer Council (NCC), which revealed how ad-tech companies collect and share vast amounts of personal data from people using mobile devices. This data is then used to profile and target consumers with personalised ads, often without a valid legal basis and without consumers’ knowledge. 

What was the risk for consumers?

In 2020, NCC’s report ‘Out of Control’ showed how the dating app Grindr shared personal data with Xandr, which was later acquired by Microsoft. Xandr in turn was able to share this information with over 4,000 companies in the advertising ecosystem.

Based on these findings, NCC and the data protection NGO noyb filed complaints to the Norwegian Data Protection Authority against Grindr and five adtech companies, including Xandr, for violating the General Data Protection Regulation (GDPR). The action was reinforced by BEUC and 10 national consumer organisations [1] who each urged their own national competition authority to investigate online advertising practices and ensure compliance with the GDPR.

The Norwegian Data Protection Authority decision means, in practice, that companies obtaining sensitive personal data for online advertising purposes have a legal obligation to ensure that this data was originally collected with valid consent: they cannot avoid responsibility for using personal data which was unlawfully collected by third parties. 

What does this decision mean for consumers? 

This decision shows the lack of transparency that exists about how our personal data is processed and shared by multiple players in online markets. 

More broadly, the decision raises serious questions about whether consumers can meaningfully control their data being collected, shared, and exploited across the online advertising industry. A business model that depends on personal data being collected without the valid consent of its customers cannot be considered lawful. 

What can we learn from the fine against Xandr for discussions on the Digital Omnibus?

This decision demonstrates the importance of having strong data protection rules and, more importantly, of ensuring that they are properly enforced. As the EU considers weakening its data protection rules - including the definition of personal data - in the Digital Omnibus, lawmakers risk giving free reign to the kind of abusive practices that this decision has just deemed illegal.  

Simplification risks becoming a backdoor to legalising such unlawful data practices. It is essential that consumer protection and privacy takes precedence over simplistic arguments for simplification. Strong data protection rules are needed to ensure corporate accountability, protect our fundamental rights and consumer trust in the data economy.

Read more:

• Forbrukerrådet press release: Microsoft company fined €8.5m following complaint by the Norwegian Consumer Council and noyb

• Forbrukerrådet Report: ‘Out of Control’

• BEUC report: The economic costs of weakening privacy and data protection

[1]   Consumentenbond (NL), EKPIZO (EL), Fédération Romande des Consommateurs (CH), KEPKA (EL), Sveriges Konsumenter (SE), Forbrugerrådet Tænk (DK), Que Choisir Ensemble (FR), Verein für Konsumenteninformation (AT), Which? (UK) and Zveza Potrošnikov Slovenije (SI)