Norway’s data protection authority, Datatilsynet, has fined Xandr, the advertising technology company now owned by Microsoft, NOK 92 million (approximately €8.6 million) for unlawfully processing and sharing personal data of Grindr users in Norway. The penalty is the largest the agency has ever issued.
Datatilsynet announced the decision on October 12, 2026. The fine covers activity between July 2018 and April 2020, when Xandr (then operating as AppNexus) acted as an intermediary in real-time bidding auctions tied to the Grindr app. According to the authority, Xandr relayed data that included the fact that individuals were using Grindr, along with advertising IDs and IP addresses, to potentially thousands of other companies. Because Grindr is a location-based dating app aimed at gay, bisexual, transgender, and queer users, the authority treated the mere fact of using the app as data concerning sexual orientation—special-category personal data under the GDPR that requires explicit consent.
Director General Line Coll said the breaches were “very serious” and that thousands of users in Norway had been subjected to unlawful sharing of sensitive information. The authority found that Xandr processed the data without a valid legal basis under Article 6(1) of the GDPR and without a valid exemption for special-category data under Article 9(1). It concluded that Xandr was a joint controller with Grindr for the relevant processing, both as a supply-side and demand-side platform, and therefore could not simply rely on whatever consent Grindr claimed to have obtained.
Xandr argued that it had assumed Grindr had secured valid consent and that responsibility rested with the app. Datatilsynet rejected that position. Coll stated that when companies in the advertising chain blame one another, users’ rights become effectively worthless. The authority also noted that Xandr derived a direct financial benefit from the data sharing and that the practice continued for nearly two years—both factors that increased the severity of the penalty. The fine was calculated on Xandr’s own turnover, not Microsoft’s, because Microsoft did not own the company during the period in question. Microsoft acquired Xandr in 2022.
The case originated with a 2020 complaint filed by the Norwegian Consumer Council, together with the privacy organization noyb, against Grindr and several adtech companies, including Xandr. Datatilsynet previously fined Grindr NOK 65 million for related breaches; that penalty was upheld by the Borgarting Court of Appeal. The Xandr decision is separate and targets the advertising intermediary rather than the app itself.
Microsoft has said user privacy is a priority and that the investigation concerns conduct that predates its acquisition of Xandr. A spokesperson indicated the company is reviewing the decision. Xandr has three weeks from receipt of the decision to appeal.
The ruling underscores that participants in programmatic advertising cannot treat consent as someone else’s problem. When special-category data moves through real-time auctions, each controller in the chain must establish its own legal basis. For Norwegian users of Grindr, the decision means the intermediary that helped broadcast their use of the app faces the highest fine Datatilsynet has imposed to date.