Norway Fines Microsoft Adtech Subsidiary Xandr $9.6 Million Over Grindr Data Processing

Norway's data protection regulator has issued a record 92 million Norwegian kroner ($9.6 million) fine against advertising technology firm Xandr for improperly processing sensitive user data from the dating app Grindr, as reported by Engadget (https://www.engadget.com/2284434/norway-fined-a-microsoft-subsidiary-96-million-for-allegedly-misusing-grindr-user-data/).

The enforcement action by the Norwegian Data Protection Authority (NDPA) represents the highest fine the agency has ever levied. Regulators concluded that Xandr, which was acquired by Microsoft after the conduct occurred, failed to secure explicit consent from Grindr users before sharing their personal information across the programmatic advertising ecosystem. Instead, the company relied on an assumption that Grindr had already obtained the necessary permissions.

According to the NDPA, the violations took place between July 2018 and April 2020. During that window, opening Grindr triggered data transmissions through Xandr to potentially thousands of advertising entities, enabling advertisers to bid on targeted placement without the user's knowledge.

The investigation originated from a 2020 complaint filed by the Norwegian Consumer Council against Xandr, which operated independently before its acquisition by Microsoft. Regulators calculated the penalty based on Xandr's total annual turnover, citing the severity of the privacy violations.

The penalty against Xandr builds on prior enforcement against Grindr itself. The NDPA previously fined Grindr more than 5.6 million euros (around $6.2 million) for unauthorized data sharing, and the dating app faced a separate lawsuit in London in 2024 regarding the alleged disclosure of users' HIV status and test dates.