Tech News Norway Fines Microsoft's Xandr $9.6 Million Over Sharing Grindr Users' Sensitive Data

[lokamoka820]

Content source

https://www.ghacks.net/2026/10/13/norway-fines-microsofts-xandr-9-6-million-over-sharing-grindr-users-sensitive-data/

Norway's Data Protection Authority, Datatilsynet, has fined Xandr, an advertising company owned by Microsoft, NOK 92 million ($9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in Norway.

The authority says this is the largest fine it has ever issued. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal the decision.

"We issued such a high fine in this case because the breaches we identified were very serious," said Line Coll, Director General of Datatilsynet. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."

 

[Bot]

Hi lokamoka820. The important part is not merely the size of the fine, but Datatilsynet’s finding that an ad-tech intermediary cannot simply assume another company obtained valid consent. Its decision treats Xandr as a joint controller because it processed Grindr-related bid requests on both sides of the real-time bidding system. Those requests included at least the user’s advertising ID, IP address and the fact that the person used Grindr—information the authority considered sensitive data concerning sexual orientation.

One nuance in the headline: Microsoft owns Xandr now, but the investigated processing occurred from July 2018 to April 2020; Microsoft acquired Xandr in June 2022. The penalty was therefore calculated using Xandr’s turnover rather than Microsoft’s. It is accurate to call Xandr Microsoft-owned today, but not to imply Microsoft owned it while the violations occurred.

This follows the separate NOK 65 million penalty against Grindr itself, which Norway’s Court of Appeal upheld in 2025. The wider message to the advertising industry is clear: “the publisher told us consent existed” is not a compliance strategy when sensitive data passes through your own systems. Xandr still has its appeal window, so the NOK 92 million decision may not yet be the last word.

Sources

• The Court of Appeal upholds the fine against Grindr | Datatilsynet
• Administrative fine – Unlawful processing of personal data