{
  "type": "NewsArticle",
  "url": "https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/",
  "slug": "norway-fines-xandr-grindr-real-time-bidding-consent",
  "title": "Norway fines Microsoft-owned Xandr €8.6 million over Grindr users' data in real-time bidding",
  "summary": "Norway's data protection authority fined ad-tech firm Xandr €8.6 million for processing Grindr users' data, which reveals sexual orientation, without valid consent. It rejected the argument that Grindr's consent was enough.",
  "section": "Privacy",
  "category": "privacy",
  "format": "news",
  "tags": [
    "GDPR",
    "consent",
    "adtech",
    "special category data"
  ],
  "published_at": "2026-10-18T13:12:00.000Z",
  "updated_at": "2026-10-18T13:12:00.000Z",
  "word_count": 411,
  "publisher": {
    "name": "Sonomos Newsroom",
    "url": "https://sonomos.ai/newsroom/",
    "standards": "https://sonomos.ai/newsroom/standards/",
    "organization": {
      "name": "Sonomos",
      "url": "https://sonomos.ai/"
    }
  },
  "follows_up": null,
  "followed_by": [],
  "sources": [
    {
      "number": 1,
      "title": "Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data",
      "publisher": "European Data Protection Board",
      "url": "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en",
      "published": "2026-10-16",
      "accessed": "2026-10-18"
    },
    {
      "number": 2,
      "title": "Xandr fined record €8.6 million for Grindr user data",
      "publisher": "The Hacker News",
      "url": "https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html",
      "published": "2026-10-13",
      "accessed": "2026-10-18"
    },
    {
      "number": 3,
      "title": "Norway fines Microsoft's Xandr NOK 92M over Grindr users' sensitive data",
      "publisher": "PPC Land",
      "url": "https://ppc.land/norway-fines-microsofts-xandr-nok-92m-over-grindr-users-sensitive-data/",
      "published": "2026-10-12",
      "accessed": "2026-10-18"
    }
  ],
  "verification": {
    "method": "automated-source-check",
    "checked_at": "2026-10-18T13:12:00.000Z",
    "description": "https://sonomos.ai/newsroom/standards/",
    "claims": [
      {
        "claim": "The fine is €8.6 million (about NOK 92 million), and the final decision is dated 2 October 2026.",
        "source": 1,
        "source_url": "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en"
      },
      {
        "claim": "The authority found Xandr processed Grindr users' data without a legal basis and processed data revealing sexual orientation without a valid exemption.",
        "source": 1,
        "source_url": "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en"
      },
      {
        "claim": "Xandr relied on Grindr's consent, and the authority held responsibility cannot be delegated between joint controllers.",
        "source": 1,
        "source_url": "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en"
      },
      {
        "claim": "Microsoft told Reuters it is reviewing the decision, and Xandr has three weeks to appeal.",
        "source": 2,
        "source_url": "https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html"
      }
    ]
  },
  "corrections": [],
  "body_markdown": "Norway's data protection authority, Datatilsynet, has fined the advertising technology company Xandr €8.6 million (about NOK 92 million) for processing the personal data of Grindr users without a valid legal basis. [The European Data Protection Board's announcement](https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en), published on 16 October 2026, says the final decision was taken on 2 October.\n\n## What the authority found\n\nAccording to the EDPB, the case began with a 2020 complaint from the Norwegian Consumer Council about real-time bidding, the automated auctions through which advertisers buy ad space, in the Grindr dating app. The authority found that Xandr processed the fact that individuals used Grindr, along with their advertising IDs and IP addresses. Because use of Grindr reveals sexual orientation, the authority treated this as special category data under the GDPR.\n\nThe EDPB says the authority found two infringements: processing Grindr users' data in Norway without a legal basis, contrary to Article 6(1), and processing data about sexual orientation without a valid exemption, contrary to Article 9(1). It described the infringements as at least negligent and highly serious because they concern core GDPR provisions and sensitive data.\n\n## Consent could not be passed along\n\nXandr was treated as a joint controller, acting as both a supply-side and a demand-side platform, according to the EDPB. For special category data, the relevant basis was explicit consent. Xandr did not obtain consent itself and relied on Grindr's, which the authority found invalid. The authority held that responsibility cannot be delegated: each joint controller must check independently that consent is valid and covers its own processing.\n\n[The Hacker News reports](https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html) that the authority said Xandr relayed Grindr users' data to potentially thousands of companies, and that it is the largest fine the Norwegian authority has issued. [PPC Land reports](https://ppc.land/norway-fines-microsofts-xandr-nok-92m-over-grindr-users-sensitive-data/) that the infringements ran from July 2018 to April 2020, before Microsoft completed its acquisition of Xandr in June 2022, and that the fine was calculated on Xandr's own turnover.\n\n## What is unresolved\n\nMicrosoft told Reuters it is reviewing the decision and assessing its options, according to The Hacker News. Both outlets report that Xandr has three weeks to appeal. PPC Land notes that the euro figure differs slightly between sources: the authority's announcement gives €8.6 million, while the privacy group noyb gives €8.5 million, and PPC Land describes the kroner amount as the binding one.\n\nThe decision has not been tested on appeal, and the sources available at publication do not include the full text of the decision.",
  "links": {
    "html": "https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/",
    "markdown": "https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/index.md",
    "json": "https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/index.json",
    "image": "https://sonomos.ai/og/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent.png"
  }
}