14 OCT 2026 — Norway's data protection authority has fined Xandr, the advertising technology company now owned by Microsoft, 92 million kroner (about €8.6 million). It found that Xandr passed the personal data of Grindr users in Norway, including data revealing their sexual orientation, to potentially thousands of other companies in automated advertising auctions without a lawful basis.
It is the largest fine the Datatilsynet has ever issued. The decision, announced on 12 October, turns on a point that reaches beyond one dating app: a company in the advertising chain cannot rely on another company's word that users agreed.
What Xandr did
According to the authority's announcement, Xandr took part in real-time bidding, the system in which an app or website shares information about a user so advertisers can bid, within a fraction of a second, to show them an advert. Xandr acted on both the buying and selling side. When a person opened Grindr, their data was in many cases relayed through Xandr to potentially thousands of companies.
Grindr is a location-based dating app for gay, bi, trans and queer people. The authority says simply being a Grindr user indicates sexual orientation, a category of data that needs explicit consent. The breaches ran from July 2018 to April 2020.
No passing the blame
Xandr argued that it believed Grindr had collected users' consent. The authority rejected that. It found Xandr was a joint controller with Grindr and "omitted to verify that the consents from Grindr were valid", said Line Coll, the authority's director general.
"Our key message is that responsibility for data protection cannot be passed on to others," Coll said. "When companies do not take responsibility and blame each other, the rights of users become, in practice, worthless."
How the fine was set
The authority said Xandr made a direct financial gain from the unlawful sharing, and treated the length of the practice as an aggravating factor. It based the amount on Xandr's own annual turnover rather than Microsoft's because Xandr was not part of Microsoft during the period in question. Xandr has three weeks from receiving the decision to appeal.
Microsoft told BleepingComputer that the case "focused on conduct that predates Microsoft's acquisition of Xandr", that the law and its enforcement have changed since, and that it is "reviewing the decision and assessing our options."
A case six years in the making
The Norwegian Consumer Council filed the complaint in 2020, working with the Austrian privacy group noyb. Grindr was fined 65 million kroner in 2021 over the same practices, and the Borgarting Court of Appeal has also ruled that such data enjoys special protection.
Noyb called the decision "a major blow to the online adtech industry" because intermediaries like Xandr "often operate in the background and are rarely held accountable". It also warned that the European Commission's proposed Digital Omnibus changes to the GDPR could take online tracking identifiers outside the law's scope, which it says Big Tech has lobbied for.
Why it matters beyond Norway
Real-time bidding works the same way across the world's apps and websites, and the companies in the middle rarely deal with users directly. If regulators elsewhere adopt Norway's reasoning, every company in an advertising chain that handles sensitive data would need its own evidence of consent, not just the word of the app that collected it.
View author profile → · Editorial policy
