GDPR: Norway fines Microsoft's Xandr €8.6 million over Grindr data

Norway's data protection authority, Datatilsynet, announced on October 12, 2026 a fine of NOK 92 million (about €8.6 million according to the authority) against Xandr. The advertising technology company, formerly AppNexus, was acquired by Microsoft in 2022. It is the largest fine ever issued by the Norwegian authority.

Sexual orientation data in ad auctions

Between July 2018 and April 2020, Xandr received and passed on personal data of Norwegian users of Grindr, a dating app used mainly by the LGBTQ+ community. The data flowed through the real-time bidding system, which allocates each ad slot in a few milliseconds. The mere fact of using Grindr reveals sexual orientation, a category of data that the General Data Protection Regulation (GDPR) protects in particular.

According to the authority, Xandr was a joint controller with Grindr. It should therefore have made sure it had users' explicit consent. Xandr argued that it believed Grindr had collected that consent and that its contracts prohibited its customers from sending it this type of data. Datatilsynet rejected those arguments. “Responsibility for data protection cannot be passed on to others,” said its director, Line Coll.

To set the amount, the authority took into account the seriousness of the violations, their duration, the financial benefit gained from sharing the data, and Xandr's own revenue, not Microsoft's.

A case that began in 2020

The case goes back to complaints filed in January 2020 by the Norwegian Consumer Council (Forbrukerrådet) and the Austrian association noyb. They targeted Grindr and several advertising intermediaries. Grindr itself was fined NOK 65 million in 2021 for the same facts. Felix Mikolasch, a lawyer at noyb, sees the decision as a useful precedent for other cases.

Asked by BleepingComputer, a Microsoft spokesperson argued that the events predate the acquisition of Xandr and that the legal framework has changed since. They added that the company is reviewing the decision and its options. Xandr has three weeks to appeal.

Key takeaways

• A technical intermediary cannot shift responsibility onto its customer: if it uses data, it must verify for itself that it has a legal basis.
• Companies that integrate advertising SDKs into their apps must know what data those SDKs transmit, and to whom.
• Data that indirectly reveals sensitive information (health, sexual orientation, religion) is treated as sensitive data.