Norway fines Microsoft's Xandr over Grindr user data
Norway's data protection authority imposed NOK 92 million, its largest fine, for processing data that reveals sexual orientation without a valid legal basis.
The Norwegian Data Protection Authority (Datatilsynet) fined Xandr, a digital advertising company now owned by Microsoft, NOK 92 million. The authority describes it as the largest it has issued so far. According to the agency, Xandr processed personal data of Grindr users in Norway, including data that reveals sexual orientation, without a valid legal basis. The decision was published on Oct. 12, 2026.
The processing took place through real-time advertising auctions: systems that offer each user's information to potential ad buyers without the user knowing. The sanctioned conduct runs from July 2018 to April 2020, and the authority treated that duration as an aggravating factor.
Datatilsynet concluded that Xandr and Grindr were joint controllers of the processing. It rejected Xandr's argument that it believed Grindr had obtained valid consent. Line Coll, the agency's director general, summed up its position in the statement: responsibility for protecting data cannot be passed on to third parties.
The figure and the deadlines
Each source gives its own equivalent. The authority speaks of about 8.6 million euros; noyb, the Austrian group that filed the complaint, says 8.5 million euros; and BleepingComputer says 9.6 million dollars. This article does not make its own conversion. The fine was calculated on Xandr's turnover and not Microsoft's, because Xandr was not part of the company during the period investigated.
Xandr has three weeks to appeal from the date it was notified of the ruling. Microsoft told BleepingComputer that the inquiry concerns events before it bought Xandr, and that it is now reviewing the ruling and "assessing our options."
Where the case came from
The case began in 2020, when noyb and the Norwegian Consumer Council filed three complaints under the GDPR, the European data protection regulation. They targeted Grindr and several advertising companies that received data through the app. Xandr's is one of them. Grindr had already been sanctioned in Norway in 2021, with a NOK 65 million fine, for similar violations; the Borgarting Court of Appeal upheld that fine.
Felix Mikolasch of noyb said the decision "sets a valuable precedent for similar cases." In practice, the penalty reaches the buyer of the data as well as the app that hands it over, which is uncommon in cases of this kind. The ruling applies in Norway and has no legal effect in Mexico, where personal data held by private parties is overseen by the Secretaría Anticorrupción y Buen Gobierno (Mexico's anti-corruption ministry).
It remains to be seen whether Xandr will appeal, and which GDPR articles were applied; the statement does not cite them, and they appear in the decision's PDF, which this newsroom did not consult.
