Norway Fines Microsoft's Xandr 92 Million Kroner Over Grindr Users' Data
Norway's Data Protection Authority has fined the advertising technology company Xandr, now owned by Microsoft, 92 million Norwegian kroner for passing data about Norwegian users of the dating app Grindr through automated ad auctions. Datatilsynet published the decision on Oct. 12, 2026. It said the amount, equivalent to 8.6 million euros, is the highest fine it has issued to date.
Datatilsynet said the point of the case is that responsibility for handling personal data cannot be passed to another company: each company must be able to show that its own processing is lawful. According to its decision notice, Xandr had argued that it assumed Grindr had collected users' consent.
The conduct the authority ruled on ran from July 2018 to April 2020, when the firm traded as AppNexus and was not yet part of Microsoft. Datatilsynet found that in that period, opening Grindr often relayed a user's data through Xandr to potentially thousands of companies in the ad market. Advertisers could then bid against each other to show that person a targeted ad, hidden from the user. It said being a Grindr user is itself information indicating sexual orientation, a category with extra protection under European data protection law.
The authority concluded that Xandr had no legal basis of its own for the processing and that explicit consent was required. It found that the company did nothing to check whether the consents Grindr obtained were valid, and that Xandr was a joint controller alongside Grindr. Datatilsynet said the length of the practice counted as an aggravating factor. It calculated the amount based on Xandr's own annual turnover, not Microsoft's, since Xandr did not belong to Microsoft then.
Xandr has three weeks from receiving the decision to appeal it, so the ruling is not final.
Datatilsynet fined Grindr 65 million kroner over equivalent breaches in 2021, and said the Borgarting Court of Appeal ruled in that case that information of this kind carries special protection. The complaint that started the case was lodged by the Norwegian Consumer Council in 2020.
