Norway Fines Microsoft Ad Unit Xandr $9.6 Million Over Grindr Data Sharing

Norway Hits Microsoft's Xandr With Its Largest-Ever Privacy Fine

Norway's data protection authority, Datatilsynet, has fined Xandr — the advertising technology company now owned by Microsoft — NOK 92 million (approximately $9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users. Datatilsynet Director General Line Coll called the violations "very serious," saying thousands of users in Norway were "subjected to unlawful sharing of their sensitive data." The decision, dated October 2, 2026, is the largest fine Datatilsynet has ever issued, and it closes a case that took 2,453 days to resolve after the original complaint was filed.

Incident Details

How It Worked

The Real-Time Bidding Pipeline

The case centers on real-time bidding (RTB), the automated auction process that sells mobile ad space in milliseconds. Each time a Grindr user in Norway opened the app, their personal data — including signals that could reveal sexual orientation — was broadcast through Xandr's ad exchange to thousands of advertising companies competing to serve a targeted ad. Datatilsynet found this occurred throughout the July 2018 to April 2020 period, exposing users' most sensitive data far beyond what any individual advertiser needed to place a bid, let alone what users could reasonably expect or control.

Joint Controller, Not Just a Vendor

Xandr argued it had simply assumed Grindr obtained valid user consent before data entered the bidstream, and said it never independently verified that assumption. Datatilsynet rejected that defense outright, ruling that Xandr was a joint data controller alongside Grindr rather than a passive processor acting on Grindr's instructions. As a joint controller, Xandr carried its own independent obligation under GDPR to confirm a lawful basis existed before processing the data — an obligation Coll said the company simply "omitted to verify."

Deleted Evidence During the Probe

The decision also found that Xandr deleted internal documentation about its Grindr data processing between July 16, 2020 and February 6, 2023 — a window that fell entirely after Datatilsynet issued its first formal information order on February 21, 2020, meaning Xandr knew it was under investigation when the records disappeared. Datatilsynet explicitly rejected the idea that missing evidence should work in Xandr's favor, warning that doing so "would in practice incentivise undertakings to erase documentation in order to circumvent supervision by data protection authorities."

Calculating the Record Fine

Because Microsoft did not own Xandr during the violation period, Datatilsynet calculated the penalty using Xandr's own annual turnover rather than Microsoft's, subject to GDPR's statutory cap of roughly €20 million. The authority treated the direct financial benefit Xandr derived from the unlawful data sharing as a major aggravating factor in setting the final amount near €8.5–8.6 million.

Impact Assessment

Recommendations

For AdTech and Programmatic Platforms

• Treat participation in RTB auctions involving special-category signals (health, sexuality, religion, etc.) as a joint-controller relationship requiring independent legal-basis verification, not a pass-through processor role
• Build consent-validation checks into bidstream ingestion rather than assuming upstream app partners have already secured valid consent
• Retain investigation-relevant records once a regulator issues any formal information request, regardless of standard data-retention schedules

For App Developers Handling Sensitive Data

• Audit every SDK and ad exchange integration for what categories of data leave the app during bid requests, including inferred attributes tied to app identity or category
• Obtain and document explicit, granular consent before any sensitive inference is shared with third parties, and confirm downstream partners honor opt-outs
• Revisit historical RTB integrations predating 2020–2021 consent-framework updates, since several jurisdictions are still litigating conduct from that era

For Privacy and Compliance Teams

• Map joint-controller relationships across the full ad-tech supply chain, not just direct vendor contracts, ahead of the next regulatory audit
• Preserve all documentation the moment any data protection authority opens an inquiry — Datatilsynet's ruling confirms deletion during a probe will not mitigate liability
• Track multi-jurisdiction exposure: the same underlying conduct can trigger separate fines from different regulators years apart

For Users

• Review ad-tracking and data-sharing settings in dating and health apps, and opt out of personalized advertising where offered
• Assume data shared through RTB auctions in the 2018–2020 era with sensitive apps may still be subject to ongoing regulatory review or future breach notifications

Key Takeaways

1. Datatilsynet fined Xandr NOK 92 million (~$9.6 million) — its largest-ever penalty — for unlawfully sharing Grindr users' sensitive data with advertisers between July 2018 and April 2020.
2. The regulator ruled Xandr was a joint data controller with Grindr, not a mere processor, meaning it carried independent GDPR obligations it failed to meet.
3. Xandr deleted relevant documentation while aware it was under investigation; Datatilsynet refused to let that work in the company's favor.
4. The fine was calculated on Xandr's own turnover, since Microsoft only acquired Xandr in 2022, after the violations occurred.
5. The case took 2,453 days to resolve from a January 2020 complaint by noyb and the Norwegian Consumer Council.
6. This follows Grindr's own NOK 65 million Datatilsynet fine in 2021 (upheld on appeal in 2025) and a separate £26 million UK settlement in September 2026 — part of a widening pattern of enforcement against Grindr's historical ad-data practices across multiple regulators.

Sources

• Norway fines Microsoft ad firm $9.6 million over Grindr data sharing — BleepingComputer
• Xandr deleted Grindr records mid-probe, Norway's NOK 92m decision shows — PPC Land
• Norway fines Microsoft's Xandr NOK 92m over Grindr users' sensitive data — PPC Land