Microsoft’s Ad-Tech Subsidiary, Xandr, Accused of Violating EU Privacy Laws

Microsoft’s advertising technology subsidiary, Xandr, is facing scrutiny from European Union privacy advocates and advertisers who claim the company is not only violating the General Data Protection Regulation (GDPR) but also mishandling advertiser data.

The privacy advocacy group, noyb (none of your business), filed a formal complaint in Italy against Xandr, alleging “highly intrusive data processing” and non-compliance with several GDPR rules. The complaint centers around Xandr’s role as a demand-side platform (DSP), a service that helps advertisers bid for ad placements on websites and apps.

Key Allegations Against Xandr

1. Excessive Data Collection: The complaint claims that Xandr collects a vast amount of personal data from users, much of which is not necessary for serving targeted advertisements. This includes browsing behavior, device information, and potentially sensitive data like location and interests.
2. Inaccurate Data: noyb also alleges that much of the data collected by Xandr is inaccurate and inconsistent, leading to poorly targeted ads that are irrelevant to users. This not only harms user experience but also wastes advertisers’ money.
3. Non-Compliance with Data Requests: The complaint further accuses Xandr of failing to comply with user requests for data access or erasure, a fundamental right under the GDPR. This means individuals have no control over their personal information held by the company.

Implications for Advertisers and Users

For advertisers, Xandr’s alleged practices could result in inefficient ad campaigns and wasted resources. Inaccurate data and poor targeting can lead to ads being shown to the wrong audience, diminishing their effectiveness and return on investment.

Moreover, the potential violation of GDPR could expose advertisers to legal and reputational risks. Companies using Xandr’s services could be held liable for non-compliance with data protection regulations, leading to fines and damage to their brand image.

For users, the excessive collection and mishandling of personal data raise serious privacy concerns. The lack of transparency and control over their information could expose them to unwanted tracking and profiling, potentially leading to discriminatory practices or manipulation.

Microsoft’s Response and the Road Ahead

Microsoft acquired Xandr in 2022 from AT&T, intending to strengthen its position in the digital advertising market. The company has stated that it is committed to complying with all applicable privacy laws and regulations. However, the complaint against Xandr raises questions about Microsoft’s ability to ensure data protection across its subsidiaries.

The outcome of the complaint could have significant implications for the ad-tech industry. A ruling against Xandr could set a precedent for stricter enforcement of GDPR, potentially leading to changes in how companies collect and process user data for advertising purposes.

As this story develops, it will be crucial to monitor how regulators and lawmakers respond to these allegations and how it impacts the future of data-driven advertising in the EU.