Norway Fines Microsoft-Owned Xandr 92 Million NOK Over Grindr Data Sharing

Norway’s Data Protection Authority has issued a 92 million NOK ($9.6 million) fine against Microsoft-owned advertising firm Xandr for unlawfully processing and sharing sensitive data belonging to Grindr users, bleepingcomputer.com reported. According to the agency, thousands of users in Norway had their personal information exposed without valid consent during real-time advertising auctions managed by the company between July 2018 and April 2020.

The Tech TL;DR:

• The Violation: Xandr acted as a joint controller for Grindr ad auctions, exposing sexual orientation and location data to thousands of advertisers without verifying valid user consent.
• The Penalty: Datatilsynet levied a 92 million NOK ($9.6 million) fine—the largest penalty ever issued by the Norwegian privacy regulator.
• The Defense: Microsoft stated that the investigation focused entirely on conduct predating its acquisition of Xandr and is currently reviewing the decision.

Datatilsynet Enforcement Action Details

The regulatory penalty stems from an extensive investigation into real-time advertising auctions utilized within the location-based dating application Grindr. Datatilsynet found that Xandr operated as a joint controller alongside the app during the period between July 2018 and April 2020. In this capacity, Xandr ingested profiling information from Grindr users and facilitated auctions where advertisers bid on ad impressions.

Line Coll, Director General of Datatilsynet, stated that the agency issued the record fine because the identified breaches were exceptionally severe. The regulator noted that Xandr assumed Grindr had secured proper user permissions under legal frameworks but failed to perform any technical or procedural validation to verify those consents. Consequently, sensitive data points—including the specific sexual orientation of individuals in Norway and abroad—were broadcasted to third parties.

Noyb and Consumer Council Challenge Commercial Surveillance

The regulatory decision follows a formal complaint filed in January 2020 by the Austrian privacy rights organization Noyb, alongside the Norwegian Consumer Council (Forbrukerrådet). Representatives from Noyb welcomed the ruling as a significant defeat for the commercial surveillance industry, pointing out that continuous user profiling requires strict legal compliance that adtech networks routinely fail to establish.

Noyb criticized the broader real-time bidding ecosystem for maintaining covert data exchanges across mobile applications, software platforms, and operating systems without explicit end-user authorization. The advocacy group emphasized that regulatory bodies are finally holding major infrastructure intermediaries financially accountable for unchecked data harvesting practices.

Microsoft Reviews Ruling on Former Xandr Operations

Xandr, which now operates as Microsoft Advertising, was granted a three-week window to appeal the decision to the relevant authorities. A Microsoft spokesperson addressed the enforcement action by clarifying that the scrutinized business operations occurred entirely before Microsoft acquired Xandr.

The corporate representative added that data privacy frameworks, compliance interpretations, and enforcement mechanisms have evolved significantly since the 2018–2020 period. Microsoft confirmed it is actively reviewing the Datatilsynet ruling and assessing available legal paths moving forward.

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.