Norway fines Microsoft's Xandr $9.6 million over Grindr data sharing

Norway's Data Protection Authority fined Xandr, the advertising unit owned by Microsoft, 92 million crowns, about $9.6 million, for unlawfully relaying Grindr users' sensitive data to thousands of advertisers, it said on 12 October 2026. The penalty is the largest the Norwegian authority has issued. Xandr has three weeks to appeal the decision.bleepingcomputer.com

The fine matters because it targets the advertising middlemen rather than the app itself, and the regulator said companies that traded in people's data could not pass the blame to others. The authority ruled Xandr shared legal responsibility with Grindr, rejecting Xandr's argument that it assumed Grindr had obtained users' consent and never checked.engadget.com

What the regulator found

Between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that potentially exposed users' data, including sensitive sexual orientation information, to thousands of companies. The data protection authority said that when a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem.aol.com

These auctions work by advertisers bidding for the right to display an ad to a Grindr user after they receive profiling information from Xandr, which acted as the intermediary. The authority wrote that advertisers could bid against each other to present targeted adverts, completely hidden from the individual user. Grindr is a location-based dating app serving the LGBTQIA+ community.

At the time, Xandr was a joint controller with Grindr, meaning it was responsible for how the data was used and should have required and obtained explicit consent from the data subjects. Xandr assumed Grindr had obtained valid consent but did not take any action to verify it, the authority said. Line Coll, Director General of Datatilsynet, said Xandr omitted to verify that the consents from Grindr were valid.

How the ad auctions worked

Coll said the breaches identified were very serious, and that thousands of users in Norway had been subjected to unlawful sharing of their sensitive data. The authority calculated the fine from Xandr's total annual turnover, and the data infringements took place between July 2018 and April 2020. The fine was based on Xandr's revenue, not Microsoft's, which did not own the unit at the time.

The case began with a 2020 complaint by the Norwegian Consumer Council, whose research exposed how apps shared user data, and Austrian data privacy organisation noyb, which filed the original complaint in January 2020. Noyb called the decision a valuable precedent. The two organisations applauded the decision, calling it a major blow to the online adtech industry.

Who complained and what follows

Microsoft said the privacy of users was a top priority. A spokesperson said the investigation and decision focused on conduct that predates Microsoft's acquisition of Xandr, and that the interpretation and application of legal standards has continued to evolve. Microsoft is reviewing the decision and assessing its options. Xandr now operates as Microsoft Advertising.

The same Norwegian agency previously charged Grindr with a fine of 65 million crowns over the same breaches in 2021, about $6.2 million. Grindr was also hit with a lawsuit in London in 2024 for allegedly sharing data that included the HIV status and test dates of its users. Xandr has three weeks to appeal the decision, and Microsoft said it is reviewing the decision and assessing its options. The regulator's ruling that advertising middlemen share legal responsibility with the app sets the terms any appeal will contest, with the appeal window running three weeks from the announcement on 12 October 2026.