Norway's Data Protection Authority (Datatilsynet) has issued a $9.6 million (NOK 92 million) penalty against Xandr, the advertising division owned by Microsoft, for the unlawful processing and distribution of sensitive personal information belonging to Grindr users within the country. The authority confirmed this represents the largest financial penalty it has ever imposed.
"We issued such a high fine in this case because the breaches we identified were very serious," stated Line Coll, Director General of Datatilsynet. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."
Between July 2018 and April 2020, Xandr operated real-time bidding systems embedded within Grindr that could have disclosed user data—including details about sexual orientation—to numerous advertising companies. The mechanism functioned as a marketplace where advertisers obtained profiling details from Xandr before placing bids to reach specific Grindr users.
During this period, Xandr held joint responsibility with Grindr as a data controller, which meant the company bore accountability for data handling practices and was obligated to secure explicit authorization from users before processing their information.
The Norwegian regulator determined that Xandr relied on Grindr's assertion that valid consent existed but performed no verification of this claim. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll explained.
Consequently, detailed personal information from Grindr users in Norway and elsewhere reached thousands of advertisers without user awareness or permission. Grindr operates as a location-based social platform serving primarily the LGBTQ+ community.
The Austrian privacy advocacy group Noyb, which lodged the initial complaint in January 2020 alongside Norway's Consumer Council (Forbrukerrådet), welcomed the enforcement action as "a major blow to the online adtech industry." The organization characterized the ruling as a significant step toward curtailing widespread practices involving the covert transfer of sensitive user information across websites, applications, platforms, and device operating systems.
"The current fine shows that companies such as Xandr are eventually held accountable for their shady practices," Noyb stated. "Profiling people's interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain."
Xandr, which now operates under the name Microsoft Advertising, has been granted a three-week window to challenge the ruling. When contacted by BleepingComputer, Microsoft's representative noted that the investigation centered on "conduct that predates Microsoft's acquisition of Xandr," emphasizing that regulatory frameworks and their application have evolved since that period. The company indicated it is "reviewing the decision and assessing our options."