Norway’s privacy regulator has imposed a record 92 million Norwegian kroner ($9.6 million) fine on Xandr, an advertising technology company now owned by Microsoft, for unlawfully handling sensitive personal information collected through the Grindr dating app. The decision highlights the responsibilities of advertising companies that process user information without directly interacting with the individuals concerned.
The Norwegian Data Protection Authority, known as Datatilsynet, announced the penalty on October 12, 2026, following an investigation into advertising practices between July 2018 and April 2020. During that period, Xandr facilitated automated advertising auctions involving Grindr users, potentially making personal information available to thousands of companies.
Grindr primarily serves LGBTQ+ users, meaning information identifying someone as an app user could reveal sensitive details about their sexual orientation. European privacy legislation places additional restrictions on processing such information, including requirements for explicit consent.
According to the regulator, Xandr participated in a system known as real-time bidding, where advertisers compete to display advertisements when someone opens an application. Personal information is distributed to potential bidders during this process, allowing companies to decide whether to target a particular user.
Investigators concluded that Xandr lacked a valid legal basis for processing the information. Although the company believed Grindr had already obtained the necessary permissions, it had not independently verified whether those permissions satisfied privacy requirements.
Datatilsynet determined that Xandr shared responsibility with Grindr for the processing activities. The ruling establishes that advertising intermediaries cannot avoid their data protection obligations simply by relying on assurances from the applications supplying personal information.
The investigation originated from complaints submitted in 2020 by the Norwegian Consumer Council and European privacy organization noyb. Their research exposed how mobile applications transmitted personal information to advertising companies, often without users understanding how extensively their data was being distributed.
Grindr previously received a 65 million kroner fine in 2021 over related violations. Norway’s Court of Appeal upheld that penalty in October 2025.
Microsoft acquired Xandr after the activities examined in the investigation had already occurred. Responding to the latest decision, the company emphasized that the conduct predated its ownership and said it was reviewing the regulator’s findings and considering its options.
The penalty, calculated using Xandr’s revenue rather than Microsoft’s, is the largest ever issued by Norway’s privacy authority. Xandr has three weeks to appeal.