Skip to content
News·noyb - European Center for Digital RightsEN
Export

Microsoft's Xandr grants GDPR rights at a rate of 0%

Data Subject Rights Advertising broker Xandr (a Microsoft subsidiary) collects and shares the personal data of millions of Europeans for detailed targeted advertising.

Full text

Data Subject Rights Advertising broker Xandr (a Microsoft subsidiary) collects and shares the personal data of millions of Europeans for detailed targeted advertising. This allows Xandr to auction off advertising space to thousands of advertisers. But: although only one ad is ultimately shown to users, all advertisers receive their data. This may include personal details concerning their health, sexuality or political opinions. Also, despite selling its service as “targeted”, the company holds rather random information: the complainant apparently is both a man, a woman, employed and unemployed. This could allow Xandr to sell ad space to multiple companies who think that they are targeting a specific group. As if that were not enough, Xandr does not comply with a single access request. noyb has now filed a GDPR complaint. Complaint against Xandr (EN)Complaint against Xandr (IT)Background: targeted advertising. If companies want to use targeted advertising to promote their products or se

How it connects

C-446/21 Maximilian Schrems v Meta Platforms Ireland Limited In a preliminary ruling arising from proceedings between Maximilian Schrems and Meta Platforms Ireland Limited, the Court of Justice of the European Union interpreted GDPR… CJEU ·Fourth Chamber Oct 4, 2024 Retention Period Personal Data IP Address
C-634/21 OQ v Land Hessen In Case C-634/21, the CJEU addressed a preliminary ruling from the Verwaltungsgericht Wiesbaden concerning OQ's challenge against Land Hessen's refusal to order SCHUFA Holding AG… CJEU ·First Chamber Dec 7, 2023 Profiling Automated Decision-Making Marketing
C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Accuracy Child Consent
VwGH Ro 2025/04/0007-7 VwGH upholds annulment of €18M GDPR fine: DPA failed to attribute infringement to natural The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures.… Jun 24, 2026 Fines Supervisory Authorities Controllers