Norway’s data protection authority, Datatilsynet, has fined the Microsoft-owned advertising company Xandr 92 million kroner, or about 8.6 million euros, for its handling of data about users of the dating app Grindr. The authority announced the penalty on Monday, 12 October. The decision is aimed at a company further along the advertising chain rather than at the app where the information was first collected.
According to Datatilsynet, Xandr processed information from Grindr users and passed it into a real-time bidding system used to sell online advertising. Through that system, the data may have reached thousands of companies that use such information to show people targeted adverts. The authority says thousands of Norwegian Grindr users were affected and that details capable of revealing their sexual orientation were sent to advertisers without the users’ explicit consent. The sensitive nature of that information, and the absence of explicit permission to share it, sit at the centre of the case.
Datatilsynet chief Line Coll described the violations as “very serious”. She stressed that a company cannot hand its data protection duties over to someone else. Each business that uses personal data must make sure, and be able to prove, that it has the right to do so. In this case, that principle was applied to Xandr as a company that received and passed on the information, rather than only to the app that collected it in the first place.
In its response, Xandr said it had believed that Grindr obtained the necessary consent from its users beforehand, before any of the data was passed on. The violations identified by the authority took place between July 2018 and April 2020, before Microsoft acquired Xandr, so the conduct under examination predates the current ownership. The company now has three weeks to lodge an appeal against the decision with the authorities.
The penalty is the second large Norwegian fine connected to Grindr data. In 2025, Norwegian courts upheld a fine of 65 million kroner that Datatilsynet had imposed on Grindr itself for unlawfully sharing sensitive information about its users. Taken together, the two cases bring the penalties linked to the app’s user data in Norway to 157 million kroner. The latest decision moves the authority’s attention from the app to the advertising technology firms that received and handled the information gathered from its users.
