Norway’s data protection authority, Datatilsynet, has fined Microsoft-owned ad firm Xandr NOK 92 million over its role in sharing Grindr users’ data through real-time ad auctions. The regulator described it as its largest fine ever.
Datatilsynet Penalizes Xandr for Ad Auctions Run Inside Grindr
The fine of NOK 92 million is equal to about $9.6 million according to one conversion and about $8.6 million according to another; the difference comes from the exchange rate used. Datatilsynet announced the penalty on October 12.
Between July 2018 and April 2020, Xandr ran real-time ad auctions inside the Grindr app. The auctions potentially exposed sensitive data, including users’ sexual orientation, to thousands of companies. The conduct covered nearly two years, and the fine is a finding about that period, not about current practices; the reports do not describe what Xandr or Grindr do today. Datatilsynet found that Xandr acted as joint controller of the data and did not verify whether Grindr had obtained valid consent from its users.
Joint Controller Status Put Consent Verification on Xandr
The finding that Xandr was a joint controller carries the weight of the decision. As a joint controller, Xandr shared responsibility with Grindr for the processing, which meant it could not treat consent as Grindr’s problem alone. Datatilsynet concluded that Xandr failed to check whether consent existed before the data flowed into its auctions.
Complaint From Norwegian Consumer Council and noyb Started the Case
The complaint behind the decision was filed in January 2020 by the Norwegian Consumer Council and the privacy group noyb. The fine arrives more than six years after that filing and covers conduct that ended in April 2020.
Datatilsynet Director General Line Coll said, “the breaches we identified were very serious.” The regulator’s account of the harm centers on thousands of Norwegian users, and others, whose sensitive data was shared without valid consent.
The size of the penalty is notable on its own terms. At NOK 92 million, it is the largest fine Datatilsynet has issued, and it was set against a company owned by Microsoft rather than the dating app alone. The case also shows how long privacy complaints can take: the filing came in January 2020, and the decision was announced in October 2026.
Sexual Orientation Data Placed in Real-Time Bidding Flows
The data at issue is among the most sensitive categories a person can disclose. Real-time ad auctions broadcast information about users to many bidders at once, which is how a single app session can reach thousands of companies. The regulator’s finding is that this exposure happened without the consent verification the law requires.
Reactions and Open Questions on an Appeal
The Norwegian Consumer Council and noyb welcomed the fine. Whether Xandr will appeal has not been stated.
The two groups that brought the complaint are a consumer body and a privacy nonprofit rather than a regulator, and their filing is what set the investigation in motion. That sequence shows how outside complaints can drive enforcement against companies that operate behind the scenes of consumer apps. Xandr’s role was not visible to Grindr’s users in the way the app itself was, yet the regulator found it carried joint responsibility for what happened to their data.
The decision sets a record for Datatilsynet, and it assigns responsibility to an ad-tech intermediary rather than only to the app that collected the data. For companies that run auctions or receive bid-stream data, the ruling signals that the regulator expects verification beyond the app itself. In this case, Datatilsynet held Xandr responsible for confirming that consent existed instead of assuming the app had handled it.
Details of the penalty come from two reports on the announcement, and neither gives a deadline or procedure for payment or appeal.
