Norway fines Microsoft-owned Xandr €8.6 million over Grindr users' data in real-time bidding

Norway's data protection authority, Datatilsynet, has fined the advertising technology company Xandr €8.6 million (about NOK 92 million) for processing the personal data of Grindr users without a valid legal basis. The European Data Protection Board's announcement, published on 16 October 2026, says the final decision was taken on 2 October.

What the authority found

According to the EDPB, the case began with a 2020 complaint from the Norwegian Consumer Council about real-time bidding, the automated auctions through which advertisers buy ad space, in the Grindr dating app. The authority found that Xandr processed the fact that individuals used Grindr, along with their advertising IDs and IP addresses. Because use of Grindr reveals sexual orientation, the authority treated this as special category data under the GDPR.

The EDPB says the authority found two infringements: processing Grindr users' data in Norway without a legal basis, contrary to Article 6(1), and processing data about sexual orientation without a valid exemption, contrary to Article 9(1). It described the infringements as at least negligent and highly serious because they concern core GDPR provisions and sensitive data.

Consent could not be passed along

Xandr was treated as a joint controller, acting as both a supply-side and a demand-side platform, according to the EDPB. For special category data, the relevant basis was explicit consent. Xandr did not obtain consent itself and relied on Grindr's, which the authority found invalid. The authority held that responsibility cannot be delegated: each joint controller must check independently that consent is valid and covers its own processing.

The Hacker News reports that the authority said Xandr relayed Grindr users' data to potentially thousands of companies, and that it is the largest fine the Norwegian authority has issued. PPC Land reports that the infringements ran from July 2018 to April 2020, before Microsoft completed its acquisition of Xandr in June 2022, and that the fine was calculated on Xandr's own turnover.

What is unresolved

Microsoft told Reuters it is reviewing the decision and assessing its options, according to The Hacker News. Both outlets report that Xandr has three weeks to appeal. PPC Land notes that the euro figure differs slightly between sources: the authority's announcement gives €8.6 million, while the privacy group noyb gives €8.5 million, and PPC Land describes the kroner amount as the binding one.

The decision has not been tested on appeal, and the sources available at publication do not include the full text of the decision.