--- title: "Norway fines Microsoft-owned Xandr €8.6 million over Grindr users' data in real-time bidding" description: "Norway's data protection authority fined ad-tech firm Xandr €8.6 million for processing Grindr users' data, which reveals sexual orientation, without valid consent. It rejected the argument that Grindr's consent was enough." url: "https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/" type: NewsArticle publisher: "Sonomos Newsroom" published: "2026-10-18T13:12:00.000Z" updated: "2026-10-18T13:12:00.000Z" section: "Privacy" format: news tags: ["GDPR", "consent", "adtech", "special category data"] word_count: 411 corrections: 0 json: "https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/index.json" sources: - title: "Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data" publisher: "European Data Protection Board" url: "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en" - title: "Xandr fined record €8.6 million for Grindr user data" publisher: "The Hacker News" url: "https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html" - title: "Norway fines Microsoft's Xandr NOK 92M over Grindr users' sensitive data" publisher: "PPC Land" url: "https://ppc.land/norway-fines-microsofts-xandr-nok-92m-over-grindr-users-sensitive-data/" --- # Norway fines Microsoft-owned Xandr €8.6 million over Grindr users' data in real-time bidding Norway's data protection authority fined ad-tech firm Xandr €8.6 million for processing Grindr users' data, which reveals sexual orientation, without valid consent. It rejected the argument that Grindr's consent was enough. Published 2026-10-18 13:12 UTC · Privacy · News · 2 min read Sonomos Newsroom. URL: https://sonomos.ai/newsroom/norway-fines-xandr-grindr-real-time-bidding-consent/ Norway's data protection authority, Datatilsynet, has fined the advertising technology company Xandr €8.6 million (about NOK 92 million) for processing the personal data of Grindr users without a valid legal basis. [The European Data Protection Board's announcement](https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en), published on 16 October 2026, says the final decision was taken on 2 October. ## What the authority found According to the EDPB, the case began with a 2020 complaint from the Norwegian Consumer Council about real-time bidding, the automated auctions through which advertisers buy ad space, in the Grindr dating app. The authority found that Xandr processed the fact that individuals used Grindr, along with their advertising IDs and IP addresses. Because use of Grindr reveals sexual orientation, the authority treated this as special category data under the GDPR. The EDPB says the authority found two infringements: processing Grindr users' data in Norway without a legal basis, contrary to Article 6(1), and processing data about sexual orientation without a valid exemption, contrary to Article 9(1). It described the infringements as at least negligent and highly serious because they concern core GDPR provisions and sensitive data. ## Consent could not be passed along Xandr was treated as a joint controller, acting as both a supply-side and a demand-side platform, according to the EDPB. For special category data, the relevant basis was explicit consent. Xandr did not obtain consent itself and relied on Grindr's, which the authority found invalid. The authority held that responsibility cannot be delegated: each joint controller must check independently that consent is valid and covers its own processing. [The Hacker News reports](https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html) that the authority said Xandr relayed Grindr users' data to potentially thousands of companies, and that it is the largest fine the Norwegian authority has issued. [PPC Land reports](https://ppc.land/norway-fines-microsofts-xandr-nok-92m-over-grindr-users-sensitive-data/) that the infringements ran from July 2018 to April 2020, before Microsoft completed its acquisition of Xandr in June 2022, and that the fine was calculated on Xandr's own turnover. ## What is unresolved Microsoft told Reuters it is reviewing the decision and assessing its options, according to The Hacker News. Both outlets report that Xandr has three weeks to appeal. PPC Land notes that the euro figure differs slightly between sources: the authority's announcement gives €8.6 million, while the privacy group noyb gives €8.5 million, and PPC Land describes the kroner amount as the binding one. The decision has not been tested on appeal, and the sources available at publication do not include the full text of the decision. ## Sources 1. [Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data](https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en), European Data Protection Board, published 2026-10-16, accessed 2026-10-18 2. [Xandr fined record €8.6 million for Grindr user data](https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html), The Hacker News, published 2026-10-13, accessed 2026-10-18 3. [Norway fines Microsoft's Xandr NOK 92M over Grindr users' sensitive data](https://ppc.land/norway-fines-microsofts-xandr-nok-92m-over-grindr-users-sensitive-data/), PPC Land, published 2026-10-12, accessed 2026-10-18 ## How this story was checked Automated source check, 2026-10-18 13:12 UTC. Each claim below was compared with the source it cites before publication. What that check does and does not cover: https://sonomos.ai/newsroom/standards/ - The fine is €8.6 million (about NOK 92 million), and the final decision is dated 2 October 2026. (source 1: https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en) - The authority found Xandr processed Grindr users' data without a legal basis and processed data revealing sexual orientation without a valid exemption. (source 1: https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en) - Xandr relied on Grindr's consent, and the authority held responsibility cannot be delegated between joint controllers. (source 1: https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en) - Microsoft told Reuters it is reviewing the decision, and Xandr has three weeks to appeal. (source 2: https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html) Tags: GDPR · consent · adtech · special category data ## About the publisher The Sonomos Newsroom is published by Sonomos, which makes Locke, desktop software that detects sensitive data on the user's device and masks it before a prompt reaches an AI service. https://sonomos.ai/locke/ General information about privacy, security and AI, not legal advice. Laws and guidance change; check the dates above and the sources cited before relying on anything here.