“We issued such a high fine in this case because the breaches we identified were very serious,” said Line Coll, Director General of Norway’s Data Protection Authority, after the regulator imposed a NOK 92 million ($9.6 million) penalty on Xandr for sharing Grindr user data without lawful consent.
Datatilsynet’s ruling and the penalty
Norway’s Data Protection Authority (Datatilsynet) concluded that Xandr, the advertising company that now operates as Microsoft Advertising, unlawfully processed and shared sensitive data belonging to Grindr users in Norway. The agency described the breaches as “very serious” and said the NOK 92 million fine is the largest it has ever issued. Datatilsynet said “thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.”
How real‑time ad auctions exposed sensitive information
According to Datatilsynet’s findings, between July 2018 and April 2020 Xandr managed real‑time advertising auctions inside the Grindr app that potentially exposed users’ data — including sensitive sexual orientation information — to thousands of companies. The authority described the technical flow: advertisers bid to display an ad to a Grindr user after receiving profiling information from Xandr, which acted as the intermediary running those auctions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildLegal responsibility and the consent failure
At the time of the activity under review, Datatilsynet said Xandr was a joint controller with Grindr and therefore responsible for how the data was used. As a joint controller, Xandr “should have required and obtained explicit consent from the data subjects for this processing.” Datatilsynet found that Xandr “assumed Grindr had obtained valid consent but did not take any action to verify it,” and that Xandr “omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing.”
Noyb and the Norwegian Consumer Council: public interest and industry impact
The enforcement action followed a complaint filed in January 2020 by the Austrian nonprofit privacy organization Noyb, together with the Norwegian Consumer Council (Forbrukerrådet). Noyb called Datatilsynet’s decision “a major blow to the online adtech industry,” arguing the ruling curbs “the unrestricted and covert exchange of sensitive user data between websites, apps, platforms, and operating systems.”
Noyb added: “The current fine shows that companies such as Xandr are eventually held accountable for their shady practices,” and warned that “profiling people’s interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain.”
Microsoft Advertising’s response and the appeal window
Xandr, which now operates as Microsoft Advertising, was given three weeks to appeal Datatilsynet’s decision. BleepingComputer reported that a Microsoft spokesperson emphasized the investigation and outcome “focused on conduct that predates Microsoft's acquisition of Xandr.” The spokesperson also said that legal frameworks and the way they are interpreted and enforced “have changed,” and that Microsoft is “reviewing the decision and assessing our options.”
What this means for Grindr users, advertisers, and Microsoft Advertising
- Grindr users: Datatilsynet’s finding highlights that sensitive information — including sexual orientation, a protected and personally revealing category — may have been exposed without explicit consent during the period examined, and that thousands of users in Norway were affected.
- Advertisers and adtech firms: The ruling calls into question the common operational practice of accepting partner assurances about consent without independent verification, since Datatilsynet singled out Xandr’s failure to verify Grindr’s consents as a central breach.
- Microsoft Advertising / Xandr: The company faces a formal opportunity to appeal and has publicly framed the matter as conduct predating its acquisition of Xandr; the firm also signaled it will consider its legal options while noting that interpretations and enforcement of legal standards have changed since the events under scrutiny.
Datatilsynet’s decision lands squarely on the question of who must verify consent when sensitive personal data are routed through complex adtech supply chains. With an unprecedented fine, the regulator has put a named stamp of enforcement on the responsibility of joint controllers to ensure a legal basis for profiling and real‑time auctioning of user data — and left both companies and users watching to see whether Microsoft will appeal.
