Norway's data protection authority, Datatilsynet, today fined Xandr, the advertising technology company now owned by Microsoft, 92 million Norwegian kroner for processing and sharing the personal data of Grindr users in Norway, including data revealing their sexual orientation, without a legal basis. The authority puts the amount at €8.6 million and calls it the highest fine it has issued to date. The infringements ran from July 2018 to April 2020, when the company still operated independently of Microsoft. Xandr has three weeks from receipt of the decision to appeal.

In Short

When people opened the dating app Grindr in Norway, information about them was passed through an ad company called Xandr to potentially thousands of other companies so they could compete to show an ad. Norway's privacy regulator says using Grindr itself reveals sexual orientation, so that sharing needed explicit consent, and Xandr never checked whether it had any. Xandr has to pay NOK 92 million, and the regulator's message is that a company cannot pass its privacy duties to someone else and blame them when it goes wrong.

What Datatilsynet decided

The decision closes a complaint that has been open for more than six years. According to Datatilsynet, the case began in 2020 when the Norwegian Consumer Council lodged a complaint against Xandr, which at that time traded as AppNexus. Xandr is now a part of Microsoft.

The authority's conclusion was that the company "did not have a legal basis to process the personal data of Grindr users in Norway." Grindr is described in the announcement as "a location-based dating app aimed at gay, bi, trans and queer people." According to Datatilsynet, being a Grindr user is itself information that indicates sexual orientation, which places the data in a category that enjoys special protection.

Three findings sit at the centre of the decision, as the authority describes them:

  • Explicit consent was required to process the data, and Xandr "had not done anything to ensure that they had valid consent."
  • Xandr was a joint controller with Grindr, not a passive pipe.
  • The company derived a direct financial benefit from the unlawful sharing, which the authority counted as "a major factor" in setting the amount.

The English-language announcement refers throughout to "data protection law" and does not cite article numbers. Norway applies the GDPR through the EEA Agreement, and the wording "explicit consent" corresponds to the exception for special category data in Article 9(2)(a) of the regulation. That mapping is PPC Land's reading; the authority's published summary does not spell it out.

"We issued such a high fine in this case because the breaches we identified were very serious. Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data," said Line Coll, Director General of the Norwegian Data Protection Authority.

How the data moved

The essence of the infringement, according to Datatilsynet, was Xandr's participation in real-time bidding, in which it acted on both the buyer and the seller side. When a person opened Grindr, their personal data was in many cases relayed through Xandr "to potentially thousands of actors in the advertising ecosystem." Advertisers could then bid against each other to present targeted ads, "completely hidden from the individual user."

The authority included a short definition in its announcement. Real-time bidding, it said, "is a technology in the advertising business where websites and apps with advertising space share personal data of visitors and users with advertising platforms." The transactions are automatic and "happen in a fraction of a second."

That dual position matters to the outcome. An exchange that both packages supply for sale and helps buyers bid on it sits at the junction through which a bid request fans out to every connected bidder. Datatilsynet's framing is that Xandr was an intermediary, but an intermediary with its own processing purposes and its own commercial interest, and therefore with its own obligations.

"This shows just how vulnerable our privacy is. Once personal data is out there, it is difficult to know where it ends up or how it gets used," Coll said. "We are talking here about information of a private nature over which someone has lost control. That information can also be combined with other data points and create an immensely detailed picture of a person's life."

Blaming the app did not work

Xandr's defence, according to Datatilsynet, was that it believed Grindr had collected users' consent. The authority rejected that argument outright and said it "does not accept that actors can simply blame one another."

"Instead, the company assumed that this was Grindr's responsibility. Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll said.

Her broader statement went further. "Our key message is that responsibility for data protection cannot be passed on to others. Each and every company must itself ensure, and be able to document, that they process personal data lawfully. This case also demonstrates how opaque the advertising ecosystem is for individuals. When companies do not take responsibility and blame each other, the rights of users become, in practice, worthless."

The reasoning closely tracks a French decision from earlier this year. In March 2026, France's Conseil d'Etat upheld Criteo's €40 million fine, rejecting the retargeting company's argument that its joint controller agreements placed consent collection on partner websites. The court held that a controller must be able to prove valid consent at any time, even where a third party gathered it. Criteo could not produce that proof when the CNIL asked for it. Two regulators in two countries have now reached the same conclusion about the same structural defence.

The joint controller finding is the hinge. Once Xandr is a joint controller with Grindr, it cannot treat the app's consent screen as somebody else's problem. Courts have been moving in that direction for years. The Court of Justice of the European Union ruled in March 2024 that TC Strings are personal data, and in May 2025 a Belgian court confined IAB Europe's joint controllership to TC String processing while upholding most of the violation findings and the €250,000 fine against the industry body.

How the amount was set

According to Datatilsynet, an administrative fine must be "effective, proportionate to the infringement and dissuasive, both for Xandr and other actors." Several factors pushed the amount up.

The authority described Xandr as "a large and leading actor in the advertising technology sector, where the very core of the business model is, in fact, the processing personal data." The duration counted against the company: the infringements took place over almost two years, from July 2018 to April 2020, and the authority said the length of the unlawful practice "was considered to be an aggravating factor."

The calculation was based on Xandr's own total annual turnover. Microsoft's turnover was not used, according to Datatilsynet, "as Xandr was not a part of Microsoft for the time period in question." That detail is significant for anyone measuring the decision against the theoretical ceiling. Under the GDPR, fines can reach 4% of the worldwide annual turnover of the undertaking, and an undertaking the size of Microsoft would put that ceiling in a different order of magnitude. The authority chose the narrower base because the conduct predated the acquisition.

Microsoft completed its acquisition of Xandr in June 2022, after AT&T agreed the sale in December 2021. AT&T had bought AppNexus in 2018 for a reported $1.6 billion. The infringement window, July 2018 to April 2020, therefore ended more than two years before Microsoft took ownership.

Norway's largest fine

The authority said NOK 92 million is the highest fine it has issued to date. The previous benchmark came from the same set of complaints. Datatilsynet's announcement states that Grindr received a fine of 65 million kroner "for equivalent breaches in 2021," and that the Borgarting Court of Appeal ruled on the special protection of the data when it dealt with that case.

That earlier figure was lower than first indicated. In January 2021, PPC Land reported that the authority had moved to fine Grindr NOK 100 million, almost €10 million, for sharing data with third-party advertisers without a legal basis. The final amount was NOK 65 million. The Oslo District Court upheld it on July 1, 2024, and the Borgarting Court of Appeal dismissed Grindr's appeal on October 21, 2025, ruling that sharing sensitive data with advertising partners without valid consent breached the GDPR.

The Xandr fine is therefore 27 million kroner, or about 42%, larger than the penalty imposed on the app whose users' data was at issue.

The two sources and where they differ

PPC Land received two accounts of the decision today. The first is Datatilsynet's own announcement, dated October 12, 2026, which is the primary source for this article. The second is a media update emailed at 11:21 the same day by noyb, the Vienna-based European Centre for Digital Rights, under the subject line "Microsoft's Xandr fined € 8.5 Million." noyb was involved in the original complaints and is not a neutral party.

The two documents agree on the fine in kroner. Both state NOK 92 million; noyb writes it as "NOK 92 000 000." They do not agree on the euro conversion:

  • Datatilsynet says NOK 92 million is "equivalent to €8.6 million."
  • noyb uses €8.5 million in its subject line and headline, and in its body text describes the fine as "roughly € 8.5 million Euros."

The gap is €100,000, or a little over 1%. Datatilsynet's figure implies an exchange rate of about 10.70 kroner per euro, noyb's about 10.82. The fine was imposed in kroner, so the kroner amount is the binding figure and the euro amounts are both approximations. This article uses the authority's €8.6 million.

The documents also describe the origin of the complaint differently. Datatilsynet credits the Norwegian Consumer Council with lodging the complaint against Xandr in 2020 and does not mention noyb. noyb says it "filed a complaint against the online advertising company Xandr" in cooperation with the Norwegian Consumer Council, and that the two organisations filed three GDPR complaints in 2020 against Grindr and several ad tech companies that received data through the app. PPC Land's 2021 coverage of the Grindr case recorded that the Consumer Council and noyb filed complaints in January 2020 naming Twitter, OpenX, AdColony, Smaato and Xandr as recipients. The accounts are compatible: the authority names the formal complainant, and noyb describes a joint effort.

One further difference is in legal vocabulary. noyb describes "GDPR violations" throughout. Datatilsynet's English announcement refers only to "data protection law" and does not name the regulation or any article.

What noyb and the Consumer Council said

noyb's media update presents the decision as a precedent for the wider industry. Felix Mikolasch, data protection lawyer at noyb, said: "We very much welcome this decision. Online adtech companies such as Xandr often operate in the background and are rarely held accountable for their practices. This sets a valuable precedent for similar cases."

Finn Myrstad, Director of Digital Policy at the Norwegian Consumer Council, was quoted in the same release: "This sends a powerful signal to everyone whose business model depends on tracking and profiling consumers. If consent is to be genuinely informed and meaningful, it is hard to see how today's surveillance-based advertising can be lawful at all."

noyb also used the decision to argue against the European Commission's Digital Omnibus proposal. According to noyb, the Commission wants to change the GDPR so that online tracking IDs no longer fall within its scope, a change the group says would mean companies "could then no longer be held accountable for breaches with these online tracking IDs." That characterisation is noyb's. The proposal itself, as the EDPB and EDPS described it in February 2026, would amend the definition of personal data in Article 4(1) so that information is not necessarily personal data for every entity merely because another entity can identify the person. The two bodies warned that the change would "significantly narrow the concept of personal data." On October 9, 2026, PPC Land reported that a Council negotiating mandate retained the Article 4(1) change, and the European Parliament has not yet adopted its position.

Norway is not an EU member and would apply any amended GDPR through the EEA Agreement.

Why this matters for the advertising industry

The fine lands on a business line Microsoft no longer runs in the same form. Microsoft shut its Invest DSP, formerly Xandr, on February 28, 2026, and steered former customers toward Amazon DSP, while the sell-side platform, Microsoft Monetize, continues to operate. The decision does not address current operations; it concerns conduct between 2018 and 2020.

Its significance for marketers lies elsewhere. The core finding, that an intermediary in the bidstream is responsible for the lawfulness of its own processing and cannot rely on an upstream party's assurance, applies to every exchange, SSP and DSP that receives bid requests from apps or sites. The authority's language is unusually direct on this point: when companies blame each other, "the rights of users become, in practice, worthless."

Consent infrastructure has grown since 2020. IAB Europe's 2025 compliance report recorded 953 registered TCF vendors and 181 consent management platforms at the end of last year, with vendor enforcement procedures up 118.2%. A framework signal, however, is a statement that consent was collected. Datatilsynet's decision, like the Criteo ruling, asks whether a recipient verified it and can document it.

The sensitivity of app identity is the second lesson. Datatilsynet treats the mere fact that a request originated in Grindr as revealing sexual orientation. Any bid request carrying an app bundle ID from a health, religious, dating or similar app may carry the same weight, regardless of whether the request contains any explicit sensitive field. Security researchers and civil society groups have pressed the same concern in the United States; in January 2025, ICCL Enforce and EPIC filed an FTC complaint alleging that Google's real-time bidding system exposes sensitive data about Americans, citing 2,365 certified bid recipients.

Whether the fine survives is an open question. An Alliance Risk analysis published in May 2026 found that roughly 40% of the €7.1 billion in announced GDPR fines since 2018 had been annulled or was under active challenge. The Grindr fine, by contrast, held through two court levels. Xandr has three weeks from receiving the decision to appeal it.

What remains unknown

Several facts are absent from both sources. Neither states the exact number of Norwegian users affected; Datatilsynet refers to "thousands." Neither discloses Xandr's annual turnover, the percentage of turnover the fine represents, or the date on which Xandr received the decision, which determines when the three-week appeal window closes. Neither says whether Microsoft or Xandr intends to appeal, and neither document includes a statement from either company. Datatilsynet's announcement does not identify the downstream recipients of the data or say whether any of them are under investigation.

Timeline

Summary

Who: Norway's data protection authority, Datatilsynet, led by Director General Line Coll, and Xandr, the advertising technology company formerly known as AppNexus and now part of Microsoft. Grindr users in Norway were the affected individuals. The Norwegian Consumer Council lodged the complaint, and noyb says it filed it in cooperation with the Council.

What: Datatilsynet fined Xandr NOK 92 million, which it puts at €8.6 million and calls its highest fine to date, for processing and sharing Grindr users' personal data, including data revealing sexual orientation, without a legal basis. The authority found that explicit consent was required, that Xandr did nothing to verify consent, and that it was a joint controller with Grindr. noyb's account converts the fine to €8.5 million, a €100,000 difference from the authority's figure.

When: The decision was published today, October 12, 2026. The infringements ran from July 2018 to April 2020. The complaint dates from 2020. Xandr has three weeks from receipt of the decision to appeal.

Where: Norway, which applies the GDPR through the EEA Agreement. The data was relayed through real-time bidding auctions to potentially thousands of companies in the advertising ecosystem.

Why: The authority rejected Xandr's argument that consent was Grindr's responsibility, setting out that each company in the advertising chain must itself ensure and document a legal basis for its processing. The fine was calculated on Xandr's own turnover, not Microsoft's, because the conduct predated the acquisition. The decision arrives as EU institutions negotiate a Digital Omnibus change to the definition of personal data that noyb argues would weaken accountability for tracking identifiers.