Norway Fines Microsoft's Xandr NOK 92 Million Over Grindr User Data

Norway's data protection authority, Datatilsynet, has fined Xandr, an advertising technology company now owned by Microsoft, NOK 92 million for unlawfully processing personal data about Grindr users. The Norwegian Consumer Council, which brought the original complaint, said on October 12 that it is the largest fine the authority has ever issued.

According to the Consumer Council, Datatilsynet found that Xandr relied on invalid consent when it processed the data in its advertising business. The data was shared through digital ad exchanges, where advertisers bid to show targeted ads. Because using Grindr itself indicates a user's sexual orientation, the data is especially sensitive under European data protection law.

The case began with a 2020 Consumer Council investigation. With the privacy group noyb, the council filed complaints against Grindr and five ad tech companies, including Xandr. Grindr was fined NOK 65 million after a similar complaint, a decision the Court of Appeal upheld in 2025.

"None of Grindr's users had a relationship with Xandr," Mette Fossum, director at the Consumer Council, said (translated from Norwegian). "This sends a strong signal to everyone who makes a living from tracking and profiling consumers."

Why it matters: Liability did not stop at the app. A downstream ad partner was fined on its own, years after the data flowed, because the consent it relied on did not hold. Dating apps carry special-category data almost by default, so every SDK, ad network and bidstream partner that touches it is a regulatory exposure for both sides. Operators serving Europe should map which partners receive user data, check that consent covers each one, and assume partners will push that risk back onto the app in their contracts.

Sources: Datatilsynet · Norwegian Consumer Council (Forbrukerrådet)