Norway Issues Record Privacy Fine to Microsoft-Owned Xandr Over Grindr Data

Norway’s data privacy watchdog has handed Xandr, a Microsoft-owned advertising company, a fine of $9.6 million (NOK 92 million). The agency, called Datatilsynet, said Xandr broke the law by processing and sharing sensitive personal data belonging to Grindr users in Norway without their knowledge.

Datatilsynet also confirmed this is the largest fine it has ever issued. The agency did not take the decision lightly.

Line Coll, Director General of Datatilsynet, explained why the fine reached such a high amount. According to Coll, “the violations identified were extremely serious.”

She added that thousands of users in Norway had their sensitive personal data shared without any legal basis. Grindr is a location-based dating app. It primarily serves the LGBTQ+ community.

How the Illegal Data Sharing Worked

Between July 2018 and April 2020, Xandr ran real-time advertising auctions inside the Grindr app. These auctions work in a specific way. Advertisers receive profiling details about a user, then bid for the right to show that user an ad. Xandr sat in the middle of that process, passing user information to bidding companies.

The data shared in those auctions included sensitive details. Sexual orientation was among the information that potentially reached thousands of advertising companies. Users had no idea this was happening.

At the time, Xandr held a role called “joint controller” alongside Grindr. That role came with legal responsibility. It meant Xandr had to make sure users gave clear and specific consent before their data was processed and shared. Xandr did not do that.

According to Datatilsynet, Xandr simply assumed Grindr had already collected valid consent from its users. The company took no steps to confirm that assumption. Coll stated that Xandr “failed to verify that the consents from Grindr were valid and took no action to ensure a proper legal basis for its own data processing.”

As a result, sensitive information about Grindr users, from Norway and other countries, reached thousands of advertisers. None of those users knew their data was being passed around. None of them gave direct and explicit consent for it.

Privacy Groups Call It a Win Against the Ad Industry

The original complaint that triggered this case goes back to January 2020. Austrian nonprofit privacy rights group Noyb filed it, alongside the Norwegian Consumer Council, known locally as Forbrukerrådet.

Both groups welcomed the Datatilsynet ruling. They called it “a major blow to the online ad tech industry.” According to Noyb, the decision pushes back against the widespread and hidden exchange of sensitive user data. That kind of exchange happens across websites, apps, platforms, and operating systems, often without users realizing it.

Noyb also pointed to the bigger picture behind the fine. The group stated that “companies like Xandr are eventually held accountable for their questionable practices.” It added that building profiles of people’s interests, location, habits, and behavior requires real and valid consent. According to Noyb, ad tech companies rarely ever obtain that consent properly.

The decision signals that regulators are watching how advertising companies handle sensitive personal data. It also reinforces that assuming consent exists is not the same as actually obtaining it.

Advertising platforms also face threats from cybercriminals who impersonate popular AI services to steal account credentials, as detailed in a report about hackers impersonating ChatGPT, Gemini, and Claude to steal advertising accounts.

Microsoft Says the Conduct Predates Its Ownership

Xandr now operates under the name Microsoft Advertising. The company received three weeks to appeal the decision.

Report says BleepingComputer reached out to Microsoft for a comment. A spokesperson responded, saying the investigation focused on conduct that occurred before Microsoft acquired Xandr. The spokesperson also noted that legal frameworks and how regulators apply them have changed since that period. Microsoft said it is currently reviewing the decision and considering its next steps.

The fine draws attention to a practice that privacy advocates have flagged for years. Real-time bidding systems, which power much of online advertising, involve the rapid sharing of user data with large numbers of companies. That sharing often happens in milliseconds, long before any ad appears on a screen. Users almost never see it happening.

For the thousands of Grindr users in Norway whose data moved through those auctions, the ruling marks a formal acknowledgment that their privacy rights were violated. Whether the fine changes how ad tech companies handle consent going forward remains to be seen.