Privacy group noyb filed a GDPR complaint against Microsoft’s advertising-technology business Xandr on July 9, 2024. The complaint alleges problems with access and deletion requests, the accuracy and breadth of advertising profiles, and the use of pseudonymous identifiers. Italy’s data-protection authority, the Garante, was reported to have opened an investigation, but the case remained pending in the latest available status. No regulator or court has found Xandr or Microsoft liable.
What happened
noyb (the European Center for Digital Rights) submitted the complaint to Italy’s Garante per la protezione dei dati personali on behalf of an unnamed individual in Italy. The filing concerns Xandr Inc., the real-time-bidding and digital-advertising platform Microsoft acquired from AT&T in 2021. Ownership does not, by itself, establish that Microsoft was the controller for every processing operation at issue.
The filing is a request for investigation and corrective action—not a judgment, penalty notice or confirmed GDPR infringement. noyb’s case tracker lists the matter as pending. In its 2024 annual report, noyb said the Garante confirmed on February 10, 2025, that it was investigating.
Read the complaint and check noyb’s case listing.
#1 Best Overall
What noyb alleges
Access and deletion requests
The complaint focuses on Xandr’s reported 2022 statistics: 1,294 access requests and 600 deletion requests, with all reported as denied. The stated reason was that Xandr could not verify requesters’ identity or jurisdiction from pseudonymous advertising identifiers.
Those figures show a reported zero-grant rate for that dataset. They do not prove that every request was valid, properly authenticated or unlawfully refused, nor that Xandr had no possible way to identify any requester. noyb’s argument is that a platform able to profile and target people should be able to provide a workable route for those same people to exercise GDPR rights.
Excessive or inaccurate profiles
noyb alleges that Xandr processed more information than necessary for advertising and that profiles could contain contradictory attributes—for example, indications that one person was both young and old. An advertising segment may be a probabilistic inference rather than a factual biography, but it can still affect which ads someone receives and raise questions about accuracy, transparency and fairness.
Rank #2
Potentially sensitive inferences
The complaint cites earlier research suggesting that Xandr’s system could process or infer information related to sex life or sexual orientation, religious beliefs and political opinions. noyb raised questions about the legal basis and consent chain for such processing. The filing does not establish that Xandr collected every listed category about every user or that no valid consent existed.
Which GDPR rules are involved?
| Provision | Plain-language issue raised by the complaint |
|---|---|
| Article 5(1)(c) | Data minimization: whether the information collected or retained was necessary for the advertising purpose. |
| Article 5(1)(d) | Accuracy: whether personal data and inferred attributes were correct and kept up to date where necessary. |
| Article 12(2) | Facilitating rights: whether Xandr made it practical for people to exercise their rights. |
| Article 15 | Access: whether individuals could learn what personal data was held and how it was used. |
| Article 17 | Erasure: whether qualifying deletion requests were honored. |
Special-category data, such as political opinions or information about sex life, receives heightened protection under the GDPR. The complaint’s references therefore raise additional legal questions, but they are allegations awaiting the authority’s assessment.
How Xandr’s adtech works
Xandr operates in real-time bidding (RTB), where advertising inventory is bought and sold programmatically as a person visits a participating site. A simplified chain is:
- A site creates an impression opportunity.
- Signals about the browser, device, context or audience may be sent to intermediaries.
- Advertisers or their platforms evaluate the opportunity and bid.
- An ad is selected and delivered.
- The event may later inform measurement, segmentation or targeting.
Processing can occur at several points and may involve publishers, advertisers, data providers and other vendors. That distribution complicates questions about who is controller or processor, which entity holds a copy, and how a deletion propagates.
Why pseudonymous identifiers matter
A mobile advertising ID or platform-generated identifier such as a Xandr UUID2 may not display a person’s name. It can nevertheless relate to an identifiable individual if Xandr or another party can link it to a device, browser, account or other reasonably available information.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Anonymous data cannot reasonably be linked back to a person.
- Pseudonymous data is separated from direct identifiers but may remain linkable.
- Personal data under the GDPR includes information relating to an identified or identifiable person.
Pseudonymization is therefore not automatically anonymity or a blanket exemption from access and erasure duties. It also does not guarantee that every request can be fulfilled: authentication, identifier rotation and the information supplied by the requester still matter.
Rank #4
What Xandr’s own documentation says
Microsoft’s Xandr Privacy Service documentation describes a client-submitted process for access and deletion requests. A member user sends an identifier—a mobile advertising ID or Xandr UUID2—to POST https://api.appnexus.com/privacy/consumer-request.
- The service acts on data associated with the relevant client account.
- Deletion disassociates the identifier from that client’s segments.
- The documentation says deletion does not create forward-looking suppression.
This is an important qualification to claims that Xandr had no deletion mechanism. It documents a technical tool for customers, while noyb challenges whether ordinary consumers could be reliably matched and served through the rights process. The documentation does not, by itself, resolve the complaint or show that deletion reaches every copy, inference, backup or downstream recipient in the adtech chain.
What the regulator may need to establish
- Which identifiers Xandr holds, how long it keeps them and what other information can be linked to them.
- What Xandr can access directly versus what is available only to customers or data partners.
- The legal basis for each processing purpose and how consent signals were obtained and recorded.
- Whether sensitive categories or sensitive inferences were created or used.
- Why all reported 2022 requests were denied and whether a workable verification route existed.
- What “deletion” means across Xandr systems, client accounts, data-provider segments, backups and downstream recipients.
- Whether the client API reflects the consumer-facing process available to EU residents.
What happens next
The Garante can request information, assess the parties’ roles and legal bases, and impose corrective measures if it finds violations. The authority could also close the matter without a finding. Any eventual decision may be subject to appeal or judicial review under the applicable procedure.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Best Value
As of the latest status available in the cited materials, there was no final infringement decision, fine or court judgment. A headline reference to a possible GDPR fine of up to 4% of a parent company’s global annual turnover describes a statutory maximum, not a predicted or expected penalty.
Why the case matters to consumers and businesses
The dispute tests a practical tension in programmatic advertising: identifiers must be usable enough to support profiling and targeting, yet companies may argue that the same identifiers are too disconnected to authenticate a rights request. It also highlights why deleting a segment entry is not necessarily the same as suppressing future collection or removing every downstream copy.
For consumers, an advertising ID is not automatically harmless because it lacks a name. For publishers, advertisers and privacy teams, consent records, vendor roles, identity matching, retention and propagation of deletion requests are operational controls—not merely policy language. The outcome could help clarify how those controls should work across a distributed RTB ecosystem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
