Norway’s data watchdog has levied a record penalty on Microsoft-owned ad firm Xandr over how it handled dating app profiles. The Xandr Grindr fine reached 92 million Norwegian kroner, or about $9.6 million. Regulators determined that the adtech company ran automated auctions inside Grindr that exposed private user profiles, including sexual orientation details, to hundreds of external business buyers without user approval [1]. Xandr now has three weeks to appeal [2].
Why Datatilsynet Issued the Xandr Grindr Fine
Line Coll, the Director General of Datatilsynet, explained that the penalty reflects the gravity of the privacy breaches uncovered during the inquiry after thousands of Norwegian dating app users had their private profile data exposed to outside ad bidders. She said that thousands of app users in Norway had their sensitive personal data exposed through automated systems without knowing it. According to the agency, Xandr assumed that Grindr had obtained valid user permission beforehand but took no steps to verify that legal basis. Coll stated that “Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing” [1].
The watchdog pointed out that companies can’t offload their basic privacy duties onto partner apps when collecting or routing personal details into digital advertising markets where real-time auctions broadcast profile records to hundreds of bidders [1]. Coll said that “Responsibility for data protection cannot be delegated to others. Each company must itself ensure, and be able to prove, that it is authorized to use this data” [3]. Because Xandr acted as a joint controller with Grindr during the period under scrutiny, it held independent legal duties toward the individuals whose information passed through its bidding software, meaning it had to verify consent directly rather than relying on unconfirmed assurances [1]. Blind assumptions breached European rules [3].
The 92 million kroner sum represents the largest fine Datatilsynet has ever imposed on any company [1]. Datatilsynet calculated the total penalty from Xandr’s annual turnover [2]. Coll said the authority chose this amount because the identified breaches were very serious. The Xandr Grindr fine established that ad brokers face direct financial accountability when they handle private profile records [1].
How Real-Time Ad Auctions Exposed User Data
Between July 2018 and April 2020, Xandr operated digital bidding systems that ran inside Grindr to sell ad space to outside buyers [1]. In real-time ad auctions, advertisers bid against each other within milliseconds to show targeted ads to someone who opens the app [2]. To make those ad impressions valuable, Xandr shared detailed profile records about Grindr users with the bidding firms. The app serves LGBTQ+ users. Participation on the dating platform can reveal a person’s sexual orientation. Relaying that profile data into an open bidding system exposed users to hundreds of outside firms [1].
Regulators noted that regular users had no way of knowing how many third parties received their personal details each time they launched the software on their phones. The NDPA described the mechanism in a public statement: “When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem. Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user”. Because the entire transaction took place in milliseconds behind the screen, people couldn’t see which marketing firms collected their profile records, nor could they discover how long those outside buyers retained the harvested records [2]. It’s this lack of transparency that alarmed privacy advocates across Europe [1].
The circumstances behind the Xandr Grindr fine show that exposure wasn’t limited to a handful of accounts. Datatilsynet found that thousands of Grindr users in Norway had their private profiles shared with outside marketing groups between July 2018 and April 2020. Users from other countries were also caught up in the automated auctions run by Xandr. None of these individuals ever gave explicit consent for their sensitive orientation data to be distributed in this manner. That gap left Xandr without any legal ground under data rules [1].
Grindr Data Penalty Follows Earlier European Actions
The enforcement action against Xandr builds on earlier regulatory proceedings that targeted Grindr itself for similar data-sharing infractions. Datatilsynet previously hit the dating platform with a fine of 65 million kroner, equivalent to more than 5.6 million euros or about $6.2 million, before Norwegian courts affirmed the regulatory order during appellate review in 2025 [2]. Grindr appealed that sanction through the judicial system, but Norwegian courts upheld the 65 million kroner penalty in 2025. That earlier court victory gave Datatilsynet a clear legal foundation to pursue the intermediaries that helped broadcast Grindr’s user data [3].
The regulatory inquiry began in January 2020 after Austrian nonprofit privacy group Noyb teamed up with the Norwegian Consumer Council (Forbrukerrådet) to file formal complaints [1]. Their filing accused adtech vendors of siphoning personal records from mobile apps without securing lawful approval [2]. Noyb cheered the new fine against Xandr, calling it “a major blow to the online adtech industry”. The Austrian group said: “The current fine shows that companies such as Xandr are eventually held accountable for their shady practices. Profiling people’s interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain” [1].
Grindr has faced legal pressure beyond Norway over how it managed private health and dating records. In 2024, the dating app was hit with a major lawsuit in London for allegedly sharing user data that included HIV status and medical test dates with outside ad networks without the explicit permission of account holders. That case showed how data shared across ad networks can compromise deeply private personal health details. While the London claim centered on Grindr’s own disclosures, the Norwegian ruling shows how ad brokers share equal liability when processing such records [2].
Microsoft Points to Conduct Before Acquisition
Xandr now operates under the name Microsoft Advertising, but Microsoft stressed that the disputed behavior took place before it bought the business. Microsoft acquired Xandr after the July 2018 to April 2020 period examined by Datatilsynet. When asked for comment by reporters, a Microsoft spokesperson said that the Norwegian investigation and its outcome “focused on conduct that predates Microsoft’s acquisition of Xandr,” adding that legal frameworks and enforcement standards have changed since that period. Microsoft confirmed it is “reviewing the decision and assessing our options” as it considers an appeal [1].
The company doesn’t have much time to make up its mind. Datatilsynet gave Xandr three weeks to file a formal appeal against the 92 million kroner order [1]. If Xandr decides to challenge the fine before the three-week deadline expires, the legal fight will move to Norwegian administrative review boards and could ultimately land before the national court system for judicial determination [3]. Regulators maintain that corporate mergers don’t wipe away liability for past data violations. Legal responsibility remains attached to the operating entity that processed the records. The appeal window lasts three weeks [1].
The Xandr Grindr fine equals roughly 8.6 million euros or $9.6 million based on exchange rates [3]. Because the penalty was calculated from Xandr’s total annual turnover, regulators sought a figure large enough to deter similar practices across the adtech sector [2]. Datatilsynet reiterated that ad businesses can’t treat user consent as a mere formality that another partner handled. Each ad player must prove compliance [3].
Adtech Profiling Practices Face Regulatory Reckoning
Privacy advocates argue that the Norwegian decision strikes at the core business model of the modern adtech industry. Noyb pointed out that the ruling puts a brake on commercial surveillance practices that rely on the covert exchange of user data between apps, websites, and platforms. The Xandr Grindr fine proves that regulators won’t accept passive assumptions when brokers handle special category data. Companies that build user profiles around location and behavior must hold verifiable consent before sharing records with bidding partners [1].
The case reflects wider European pushback against opaque monetization models in consumer software. Consumer organizations across the continent have grown increasingly willing to take tech companies to court over unlawful commercial practices, similar to when a Dutch consumer group sued Epic Games over commercial practices affecting users in digital game storefronts. In both instances, advocacy groups challenged digital business models that collected or monetized user details without transparent permissions. Regulators are backing these complaints with record penalties to force changes in ad ecosystems [2].
As the three-week appeal window counts down, the decision stands as a clear signal to ad brokers operating across Europe. Ad intermediaries can no longer shelter behind mobile app publishers while transmitting sensitive profiling data into real-time bidding systems. Forbrukerrådet and Noyb have shown that joint controllers will be held accountable for each link in the data-sharing chain. European watchdogs are signaling that tracking sensitive personal traits for profit requires unambiguous, verified consent from every user [1].
- ONLINE NEWS Toulas, B. (2026, October 12). Norway fines Microsoft ad firm $9.6 million over Grindr data sharing. BleepingComputer. [Article Link]
- ONLINE NEWS Chen, J. (2026, October 12). Norway fined a Microsoft subsidiary $9.6 million for allegedly misusing Grindr user data. Engadget. [Article Link]
- ONLINE NEWS Zinin, A. (2026, October 12). Norway fines Microsoft subsidiary for sharing Grindr user data. Tech Xplore. [Article Link]
