Norway's Record Fine for Microsoft's Xandr Is a Reminder That Free Apps Are Not Free

Nothing in this case should surprise anyone. The useful question it raises is not whether your data travels, but which data you are willing to let go.

Norway’s data protection authority, Datatilsynet, has fined Xandr, Microsoft’s advertising technology subsidiary, 92 million Norwegian kroner, about $9.6 million. It is the largest fine the authority has ever issued. Between July 2018 and April 2020, Xandr used sensitive data from users of the dating app Grindr for advertising without their explicit consent, assuming Grindr had already obtained it. The regulator rejected that excuse: Xandr was responsible for making sure the data was handled legally. In many cases, opening Grindr was enough for a user’s data to be relayed through Xandr to potentially thousands of companies, which bid against each other to show targeted ads, out of the user’s sight. The complaint dates back to 2020, before Microsoft owned Xandr. Xandr has three weeks to appeal. Grindr itself was fined 65 million kroner in the same affair, a fine upheld on appeal in 2023.

Free apps? I find that hard to believe. Most of them are paid for somehow: with payments, with ads, or with your data. There is research pointing the same way. A 2018 University of Oxford study of about 959,000 free Android apps in the US and UK found that 88.4% could send data to companies owned by Google’s parent, Alphabet. “Could” is the operative word, and Google disputed the method, but it tells you what the default looks like. In my view, most of the apps that genuinely make no money from you are open source. I have not counted them, so take that as an impression.

Paying does not get you out either. One way or another, our data ends up circulating, whether we pay or not. I take that as a given. The question I always come back to is a different one: what data are you willing to give these companies? Location, contacts, health, who you date. Those are not the same thing, and the apps you keep should reflect that.

Read the Engadget report, then open the privacy settings of the apps you use most and see what they are allowed to share.