Regulators in Norway have hit Xandr — Microsoft’s former ad-tech division — with a €8.6 million ($9.62 million) fine for illegally sharing sensitive personal data from Grindr users, including information revealing their sexual orientation. This ruling, issued by the Norwegian Data Protection Authority (DPA), stands as its most significant penalty to date under the country’s data protection laws. The violations took place between July 2018 and April 2020.
What happened and why it’s a serious breach
The investigation found Xandr acted as a joint controller alongside Grindr, meaning it bore responsibility for securing valid user consent before processing their personal data. But rather than obtaining this consent itself, Xandr assumed Grindr had already done so. Instead, it enabled real-time advertising systems to relay sensitive information — including users’ sexual orientation — to potentially thousands of advertisers every time the app was opened.
These practices were hidden from users, who had no transparency into how their data was shared or used. The DPA stressed that such secretive data transfers — especially involving deeply private traits — represented “very serious” infringements of user privacy and data protection norms.
Legal findings and consequences
Under Norwegian law, both joint controllers are equally responsible for ensuring legal compliance, including gathering consent where required. Since it determined Xandr failed in this duty, the DPA imposed the full fine based on the company’s annual turnover during the period in question — a method used to ensure penalties reflect the scale of wrongdoing. Xandr has three weeks to file an appeal.
The fallout is already being felt more widely. Privacy advocates hailed the decision as a milestone in holding ad-tech firms accountable for what many considered invasive data collection practices. Meanwhile, Microsoft is reviewing the ruling to decide next steps.
Recent privacy controversies have also surrounded Grindr itself; in the UK, for example, it recently agreed to pay £26 million (about $35.1 million) to settle a lawsuit over similar accusations involving data sharing of users’ sensitive health information.
As real-time bidding and programmatic advertising become more embedded across digital ecosystems, the Xandr/Grindr case underscores growing regulatory scrutiny of how platforms handle personal data. This is especially true for traits that carry high risk under privacy laws, like sexual orientation or health status. Companies operating in ad-tech must now examine whether their consent processes meet legal standards, and whether their partnerships expose them to liability for sensitive data leaks.
