Norway's NOK 92m fine on Microsoft's Xandr is final

Norway's NOK 92m fine on Microsoft's Xandr is final

3 November 2026: Norway's data protection authority, Datatilsynet, has fined Xandr, the advertising technology company now owned by Microsoft, NOK 92 million (about €8.6 million) for passing the sensitive personal data of Grindr users through real-time bidding without a legal basis. It is the largest fine the authority has issued. On 3 November it updated its notice to say that Xandr had not appealed and the decision is final.

Not yet independently verified. The page we read is the authority's updated notice of 3 November; it does not show when the fine was first announced, and we have not read the full decision PDF. We will update this when it can be confirmed, and remove this note.

"Responsibility for data protection cannot be passed on to others," said Line Coll, Datatilsynet's director general. "Each and every company must itself ensure, and be able to document, that they process personal data lawfully."

Data sold in a fraction of a second

The case began in 2020 with a complaint from the Norwegian Consumer Council against the company, then called AppNexus. Xandr worked on both the buying and the selling side of real-time bidding. When someone in Norway opened Grindr, a dating app for gay, bi, trans and queer people, their data was in many cases relayed through Xandr to potentially thousands of advertising companies, which bid against each other to show them an advert.

Being a Grindr user is itself information that reveals sexual orientation, which the GDPR protects as special category data. Datatilsynet notes that the Borgarting Court of Appeal upheld that view when it confirmed a NOK 65 million fine on Grindr itself for the same practice in 2021.

"We thought Grindr had consent" did not work

Xandr's defence was that it believed Grindr had collected users' consent. The authority rejected it. Processing this kind of data needed explicit consent, and Xandr had done nothing to check that Grindr's consents were valid or to secure a legal basis for its own processing. Datatilsynet found that Xandr was a joint controller with Grindr, not a mere processor passing data along.

The infringements ran for almost two years, from July 2018 to April 2020. The authority counted the length of the practice and the direct financial benefit Xandr drew from it as aggravating factors. It based the fine on Xandr's own annual turnover rather than Microsoft's, because Xandr was not part of Microsoft at the time.

What this means for every party in an ad chain

The reasoning reaches beyond one exchange. Any company that receives personal data through a bid stream, whether a supply-side platform, a demand-side platform or an advertiser, is expected to verify the consent signal it relies on and to document that check, not to assume the app or site upstream got it right. Contracts that place all consent duties on the publisher do not move the duty.

For businesses that buy programmatic advertising, that turns into two questions for their platforms: how they validate consent strings for special category data, and which bid requests they drop rather than pass on. Our ad server software category lists 15 products.

Datatilsynet has published the decision as a PDF in Norwegian with an English notice.

Related on TrustList:

• CNIL fines Fnac Darty €7m over an app tracker used without consent

Sources

• Datatilsynet: Microsoft company fined NOK 92 million (updated 3 November 2026: decision final), 3 November 2026