Norway’s data protection regulator has hit Microsoft’s advertising arm Xandr with a 92 million kroner ($9.6 million) fine for sharing Grindr users’ sensitive data with advertisers without a l
Norway’s data protection regulator has hit Microsoft’s advertising arm Xandr with a 92 million kroner ($9.6 million) fine for sharing Grindr users’ sensitive data with advertisers without a legal basis. The penalty will be the largest the agency has ever imposed on a company.
Datatilsynet, the Norwegian authority behind the ruling, claimed the data involved information that could reveal users’ sexual orientation. The final decision closes a case that has been ongoing in Norway for over six years.
The case involves real-time bidding, a process that sells ad space in milliseconds as a user opens an app. When an individual launched the Grindr app in Norway, their personal data was sent through Xandr and potentially shared with thousands of companies and firms in the advertising industry, according to Datatilsynet. These companies then competed to deliver targeted ads to the user.
Because Grindr caters to gay, bisexual, trans and queer users, the regulator considered app usage alone enough to reveal a person’s sexual orientation. Under European data protection rules, that makes the information sensitive data that requires explicit consent to process.
The Norwegian authority found that Xandr had failed to obtain the required consent. It also ruled that the company shared responsibility for handling the data with Grindr, instead of just acting as an intermediary. Xandr’s direct financial benefit from the data sharing was another key factor in assessing the magnitude of any fines.
Xandr argued that it assumed Grindr had already collected valid consent from its users, an argument that was rejected by the regulator.
“Responsibility for data protection cannot be delegated to others,” Datatilsynet Director General Line Coll said in the authority’s statement, as quoted by Tech Xplore. The director claimed each company must independently ensure and be able to demonstrate that it has a legal basis for using the data it procures.
Coll said the breaches were particularly serious, noting that the sensitive personal data of thousands of Norwegian users had been shared illegally. The data sharing took place between July 2018 and April 2020, before Microsoft acquired the business, then known as AppNexus, PPC Land reported. Xandr now has three weeks to challenge the ruling at an appeal.
The Norwegian decision follows a similar case in France earlier in 2026, where the Conseil d’Etat upheld a €40 million fine against retargeting company Criteo, rejecting its claim that partner websites were responsible for collecting consent. The two decisions make clear that companies remain accountable for data protection, and cannot rely on partners to collect user consent.
The complaint was filed in 2020 by the Norwegian Consumer Council and privacy group noyb over Grindr’s data-sharing practices. It was one of three complaints lodged that year, targeting both the app’s handling of user data and the adtech companies that received it.
Felix Mikolasch, a data protection lawyer at noyb, said the ruling could force greater accountability from adtech firms such as Xandr, whose operations are often largely unseen and unnoticed by the public, describing the decision as an important precedent for similar cases in a statement from the group.
Finn Myrstad, director of digital policy at the Norwegian Consumer Council, said the decision puts companies that rely on user tracking on notice. The latest ruling comes after Grindr faced a similar penalty in Norway. In 2025, the country’s courts upheld a 65 million kroner fine against the app for illegally sharing users’ sensitive personal information.
The fine targets a company that is valued at around $3.97 trillion, according to GuruFocus. However, noyb has also warned that the precedent could lose its intended effect if the European Commission’s proposed Digital Omnibus weakens how the GDPR treats online tracking IDs. This proposal is currently under consideration by the European Parliament and Council.
If you're reading this, you’re already ahead. Stay there with our newsletter.
