Norway's data protection regulator has fined Xandr, the advertising technology subsidiary of Microsoft, 92 million Norwegian kroner, or roughly $9.6 million, over its handling of Grindr users' personal information. The Norwegian Data Protection Authority announced the penalty, saying Xandr failed to secure explicit consent before using sensitive data from the dating app for advertising. The agency said the amount is the largest fine it has issued to date. The case centers on how Grindr users' information moved through Xandr into the broader advertising market.
According to the NDPA, Xandr relied on the assumption that Grindr had already obtained user approval rather than getting explicit consent itself. The regulator said that when a person opened Grindr, their personal data was in many cases passed through Xandr to potentially thousands of participants in the advertising ecosystem. That flow, the agency said, allowed advertisers to bid against one another to serve targeted ads without the individual user knowing. The NDPA described the data misuse as very serious, which it cited as justification for the size of the fine.
The regulator said the penalty was calculated based on Xandr's total annual turnover. It also said the data infringements occurred between July 2018 and April 2020. The NDPA's action follows a complaint filed in 2020 by the country's consumer council, which accused Xandr of unlawfully sharing users' personal data for commercial purposes without first obtaining consent. Xandr was not owned by Microsoft at the time the complaint was filed. The Norwegian authority's investigation ultimately led to the charge announced this month.
Xandr is not the only company to face scrutiny in Norway over Grindr-related data practices. The same agency previously fined Grindr more than 5.6 million euros, or around $6.2 million, for similar reasons. In 2024, Grindr also faced a lawsuit in London alleging it shared data that included users' HIV status and test dates. The Norwegian regulator's latest penalty against Xandr adds to a growing set of European enforcement actions targeting how dating apps and advertising intermediaries handle sensitive personal information.
For US readers, the case highlights the reach of European privacy enforcement over American technology companies and their subsidiaries. Microsoft owns Xandr, and the fine lands on a US-based parent company's unit, even though the conduct at issue predates that ownership. The NDPA's decision reflects the European Union's broader push to require explicit consent before sensitive data, including information tied to dating app use, is shared with advertising platforms. The agency has not indicated whether Xandr plans to contest the fine.
More company and startup news from TechManNews.
