Norway fines Microsoft-owned Xandr €8.6m over Grindr ad data

Norway fines Microsoft-owned Xandr €8.6m over Grindr ad data

12 October 2026: Norway's data protection authority, Datatilsynet, has fined the advertising technology company Xandr NOK 92 million, about €8.6 million, for passing on data about users of the dating app Grindr through real-time ad auctions without a legal basis. It is the largest fine the authority has issued.

What Xandr did

Xandr, known as AppNexus when the conduct took place and now part of Microsoft, acted on both sides of real-time bidding: as a supply-side platform selling ad space and as a demand-side platform buying it. When a person in Norway opened Grindr, their data was in many cases relayed through Xandr to potentially thousands of companies bidding to show them an advert. The authority found that Xandr processed at least the fact that a person used Grindr, their advertising ID and their IP address. Because Grindr is aimed at gay, bi, trans and queer people, using it reveals sexual orientation, which is special category data under Article 9 of the GDPR.

The case began with a complaint by the Norwegian Consumer Council in 2020 and covers July 2018 to April 2020. The final decision is dated 2 October 2026.

Why relying on the app's consent failed

Explicit consent was the only legal basis available for this data. Xandr argued that Grindr had collected consent; the authority found Grindr's consents invalid and Xandr a joint controller with Grindr, so it had to verify consent for its own processing. "Each and every company must itself ensure, and be able to document, that they process personal data lawfully," said Line Coll, the authority's director general. The breaches of Articles 6(1) and 9(1) were judged at least negligent and of high seriousness. Grindr itself was fined NOK 65 million for the same practices in 2021, a decision upheld by the Borgarting Court of Appeal.

How the amount was set

The authority calculated the fine from Xandr's own annual turnover, not Microsoft's, because Xandr was not part of Microsoft during the period in question. The direct financial benefit Xandr drew from the sharing and the near two-year duration counted against it. Xandr has three weeks from receiving the decision to appeal.

The lesson for ad buyers and publishers

The ruling turns on a point any company in an ad supply chain can check: a platform that receives personal data from an app or site cannot rely on the partner's consent banner without verifying that it is valid and covers the platform's own use. Publishers sending bid requests from apps whose very use is sensitive, such as health, religion or dating, carry the same exposure. Our ad server software category lists 15 products.

Sources

• Datatilsynet: Microsoft company fined NOK 92 million, 12 October 2026
• EDPB: Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data, 16 October 2026