The Norwegian Data Protection Authority (Datatilsynet) has imposed a record NOK 92 million (€8.6 million) fine on Microsoft-owned advertising technology company Xandr for unlawfully processing and sharing sensitive Grindr user data. The penalty, announced on 12 October, is the largest ever issued by the Norwegian regulator.
According to the authority, thousands of Grindr users in Norway were affected by the unlawful sharing of personal information between July 2018 and April 2020. The data, which could reveal users’ sexual orientation, was transmitted through Xandr to potentially thousands of companies involved in online advertising.
The decision goes beyond the dating app itself, establishing that advertising intermediaries cannot rely solely on other companies to ensure compliance with data protection rules.
How Grindr user data entered advertising auctions
Grindr is a location-based dating app primarily serving gay and bisexual men and other members of the LGBTQ+ community. Under the European Union’s General Data Protection Regulation (GDPR), information revealing a person’s sexual orientation receives special protection.
The Norwegian investigation found that Xandr participated in real-time bidding, an automated advertising system in which companies compete to display personalised advertisements to individual users.
When someone opened Grindr, personal information was, in many cases, transmitted through Xandr to a network of potential advertising partners. These companies could then bid for advertising space based on the information received, with the entire process taking place in fractions of a second.
The regulator found that Xandr operated on both the buying and selling sides of these transactions, distributing sensitive information without a valid legal basis.
Why Xandr was held responsible
The central issue was consent. Xandr argued that it had assumed Grindr was responsible for obtaining permission from users before sharing their information.
However, Datatilsynet concluded that Xandr had failed to verify whether Grindr had obtained valid consent and had not established a legal basis for its own processing activities.
The authority therefore determined that Xandr and Grindr were joint data controllers, meaning both companies were responsible for ensuring that the personal information was processed lawfully.
Line Coll, Director General of the Norwegian Data Protection Authority, emphasised the wider implications of the decision:
Our key message is that responsibility for data protection cannot be passed on to others.
The regulator also warned that once sensitive information enters complex advertising networks, individuals may lose control over where their data goes and how it is subsequently used.
A case dating back to 2020
The investigation originated from complaints submitted in 2020 by the Norwegian Consumer Council and the privacy organisation noyb, following research into how mobile applications shared personal information with advertising companies.
Grindr itself received a NOK 65 million (€6.1 million) fine in 2021 for related violations. That penalty was upheld by Norway’s Borgarting Court of Appeal in October 2025, with the judgment becoming final the following month.
In determining Xandr’s penalty, the authority considered the duration of the violations, the company’s financial benefit from the unlawful processing and the seriousness of exposing sensitive personal information.
The amount was calculated using Xandr’s own annual turnover rather than Microsoft’s, since the company was not part of Microsoft when the violations occurred.
According to Reuters, Microsoft said the conduct predated its acquisition of Xandr and that it was reviewing the decision and assessing its options.
Xandr has three weeks from receiving the decision to appeal.
For the wider European advertising industry, the ruling reinforces a central requirement of the GDPR: companies that obtain and process sensitive personal information must independently establish that their activities are lawful, even when the data originally comes from another platform.
