Norway’s data protection authority, Datatilsynet, on October 12 announced an administrative fine of NOK 92 million, about €8.6 million, against Xandr, the advertising technology company now owned by Microsoft. The regulator found that Xandr passed personal data of Grindr users in Norway, including data revealing their sexual orientation, through real-time ad auctions without a legal basis. It said the penalty is the highest it has ever issued.

The decision, dated October 2, 2026, finds two breaches of the General Data Protection Regulation (GDPR): processing personal data without a legal basis under Article 6(1), and processing special category data without a valid exemption under Article 9(1). Xandr has three weeks from receiving the decision to appeal.

What the regulator found

The case concerns real-time bidding (RTB), the automated auctions in which apps and websites share information about a user with advertising platforms so advertisers can bid to show that person an ad. Datatilsynet said that when someone opened Grindr, a location-based dating app aimed at gay, bi, trans and queer people, their data was in many cases relayed through Xandr to potentially thousands of companies in the ad ecosystem.

According to the decision, the regulator found it proven that Xandr processed at least the fact that individuals were using Grindr, their advertising IDs and their IP addresses. Because using Grindr itself indicates sexual orientation, the authority treated that information as special category data, which requires explicit consent.

Xandr acted on both sides of the auctions, as a supply-side and a demand-side platform, and the regulator found it was a joint controller with Grindr. Xandr did not collect consent itself but relied on consent gathered by Grindr, which the regulator had already found invalid. The decision states that “accountability cannot be outsourced” and that each joint controller must check for itself that consent is valid and covers its own processing.

“We issued such a high fine in this case because the breaches we identified were very serious,” said Line Coll, Director General of the Norwegian Data Protection Authority. “Our key message is that responsibility for data protection cannot be passed on to others.”

Xandr argued that it believed Grindr had obtained users’ consent, the regulator said. In its June 2025 response to the advance notice, Xandr also said it did not create the audience segments that advertisers targeted but obtained them from third parties. The authority rejected that argument, finding that Xandr influenced the processing because advertisers could choose segments that Xandr made available.

How the fine was set

The infringements ran from July 2018 to April 2020, and Datatilsynet treated that duration as an aggravating factor, along with the direct financial benefit Xandr drew from the sharing. The decision counts the long case handling time as a mitigating factor.

The fine was calculated on Xandr’s own turnover rather than Microsoft’s, because Xandr was not part of Microsoft during the period in question. On that basis the legal maximum was €20 million, since that figure exceeded 4% of Xandr’s worldwide annual turnover. The decision says the fine falls within the €4 million to €20 million range set out in European Data Protection Board guidance on calculating fines.

The complaint was filed in 2020 by the Norwegian Consumer Council. Grindr itself was fined NOK 65 million in December 2021 for sharing user data with advertising partners without a valid legal basis. The finding that Grindr’s consents were invalid was later upheld by the Privacy Appeals Board, the Oslo District Court and the Court of Appeal, according to the decision.

Company response

A Microsoft spokesperson told BleepingComputer that the investigation focused on conduct that predates Microsoft’s acquisition of Xandr and that the company is reviewing the decision and assessing its options. The Austrian privacy group noyb, which BleepingComputer said was involved in the original complaint, called the decision “a major blow to the online adtech industry.”

Why it matters

The decision targets an intermediary rather than the app that collected the data. Its central finding is that an ad-tech firm in a joint controller role cannot rely on a publisher’s consent without checking it. Coll said the case shows how opaque the advertising system is for individuals, and that when companies blame each other, users’ rights become worthless in practice.

The regulator said the fine had to be effective, proportionate and dissuasive, both for Xandr and for other companies in the sector. To base the amount on Xandr’s own turnover rather than its new parent’s, the decision cites a Court of Justice of the European Union ruling, YKK, in which the court found that a fine for conduct before an acquisition should be based on the turnover of the company that committed it.

What to watch

If Xandr appeals and Datatilsynet upholds its decision, the case goes to the Norwegian Privacy Appeals Board, the decision says. Any appeal must first be sent to Datatilsynet within three weeks of Xandr receiving the decision.

Corrections and tips: email the editor using the address on the Contact page.