Norway's data protection authority, Datatilsynet, has imposed a 92 million kroner ($9.6 million) fine on Xandr, a subsidiary of Microsoft, for unlawfully sharing sensitive user data from the dating app Grindr. The penalty, announced on October 12, 2026, is the largest ever issued by the Norwegian regulator. Datatilsynet found that Xandr, operating as an advertising intermediary, transmitted data that could reveal Grindr users' sexual orientation to thousands of advertisers through real-time bidding auctions without obtaining explicit consent. This activity occurred between July 2018 and April 2020, a period predating Microsoft's acquisition of Xandr.
The Norwegian authority ruled that Xandr could not pass its data protection responsibilities onto Grindr, rejecting Xandr's argument that it assumed the dating app had secured user permission. Datatilsynet stated that companies trading in personal data cannot evade blame by passing responsibility to others. The fine was calculated based on Xandr's revenue, as Microsoft did not own the unit at the time of the violations.
This case originated from a 2020 complaint filed by the Norwegian Consumer Council and the privacy advocacy group noyb. The complaint challenged Grindr's data-sharing practices and the role of adtech companies that received user data. The Norwegian regulator previously fined Grindr 65 million kroner in 2021 for similar breaches, a decision upheld by Norwegian courts. Privacy advocates, including Felix Mikolasch of noyb, have described the ruling as a significant precedent that could increase accountability for advertising technology firms. Finn Myrstad of the Norwegian Consumer Council noted that the decision alerts companies reliant on user tracking.
Xandr has a three-week period to appeal the decision. Microsoft stated that user privacy is a priority and that the investigation focused on conduct predating its acquisition of Xandr, adding that the company is reviewing the decision and assessing its options. The ruling underscores a broader regulatory trend to hold all parties in the data supply chain accountable under privacy laws like the General Data Protection Regulation (GDPR).