"Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies," the Norwegian Data Protection Authority said.
The Norwegian DPA's ruling and the fine
The Norwegian Data Protection Authority (DPA) has fined Xandr €8.6 million ($9.62 million) for relaying Grindr users' sensitive personal data to advertisers without a lawful basis. The administrative penalty is the largest issued by the watchdog and, the authority said, reflected the "very serious" nature of the breach. The infringements took place between July 2018 and April 2020. Xandr has three weeks to appeal the decision.
How the relay happened: real‑time bidding and broad dissemination
The DPA's investigation concluded that Xandr acted as an intermediary in so‑called real‑time bidding, participating "both on the buyer and seller side." According to the authority, when a person opened the Grindr app, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem. Advertisers could then bid against each other to present targeted adverts, the watchdog said — a process that occurred "completely hidden from the individual user."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildJoint‑controller finding and consent responsibility
The regulator found Xandr to be a joint controller with Grindr. As a joint controller, the DPA said, Xandr was responsible for obtaining users' consent before processing the data. Instead of establishing its own legal basis for processing, the authority said Xandr pointed to Grindr and "assumed the online dating app had collected users' consent to do so."
Responses and related litigation
Industry responses were swift and varied. In a statement shared with Reuters, Microsoft said it is reviewing the DPA decision and "assessing its options." Privacy group None of Your Business (noyb), which joined Norway's consumer council in filing the 2020 complaint against Xandr, described the fine as a "major blow for the online advertising and commercial surveillance industry" and said that "companies such as Xandr are eventually held accountable for their shady practices."
The case follows other legal settlements tied to third‑party sharing of user data. Last month, Grindr opted to pay £26 million ($35.1 million) to settle a U.K. lawsuit alleging it shared users' personal information, including HIV status, with third parties. Separately, a Texas federal judge granted final approval to a $177 million AT&T settlement for consumer classes whose personal information was exposed in two separate data breaches; that class‑action settlement was reached in November 2025.
The filings related to the AT&T cases named two specific incidents: a March 2024 publication of a dataset on the dark web containing Social Security numbers — said to have affected about 7.6 million current AT&T account holders and approximately 65.4 million former account holders — and a second hack in which threat actors illegally downloaded AT&T customer data from a third‑party cloud platform hosted by Snowflake, compromising calls and text message records from May 1 to October 31, 2022 for "nearly all" cellular customers, the company noted at the time.
What this means for technologists, regulators, and end users
- Technologists and security teams: The DPA's description of data being relayed "to potentially thousands of actors" during real‑time bidding highlights the practical reach of adtech pipelines during the July 2018–April 2020 window and the need to account for how sensitive attributes can travel through those flows.
- Regulators and procurement leaders: The DPA said it calculated the fine taking into account Xandr's total annual turnover during the two‑year period at issue — a reminder that penalties can reflect company scale and historical conduct. Xandr's three‑week appeal window is now the immediate procedural next step.
- End users and the general public: The DPA's finding affirmed that thousands of Grindr users in Norway were subjected to unlawful sharing of sensitive data, with potential exposure of sexual orientation to commercial actors hidden from users.
The DPA's decision ties together a regulatory finding about joint responsibility, a technical description of real‑time bidding flows, and a financial penalty calculated against historical turnover. Xandr — a platform formed by AT&T after its June 2018 acquisition of AppNexus, later sold to Microsoft in late December 2021 and folded into Microsoft Ads in June 2023 — now faces an appeal deadline while Microsoft assesses its options. The complaint that sparked this ruling dates to 2020, filed by Norway's consumer council and noyb; the DPA's order and noyb's reaction frame the outcome as a test case for how far regulators will go to constrain commercial surveillance in advertising.
