Norway's data protection regulator issued an €8.6 million penalty to Xandr, a former advertising subsidiary of Microsoft, for unlawfully transmitting Grindr users' sensitive personal information to advertisers without proper consent. The fine, handed down Monday and totaling $9.62 million, represents the largest sanction the Norwegian Data Protection Authority has ever levied. Between July 2018 and April 2020, Xandr operated as a joint controller alongside Grindr, relaying data that exposed users' sexual orientation to potentially thousands of companies through real-time bidding systems.
The investigation revealed that Xandr participated in real-time bidding on both the buying and selling sides, transmitting sensitive user information each time someone opened the dating app. The penalty amount reflects Xandr's total annual revenue during the two-year violation period, which occurred before Microsoft purchased the company in December 2021 for $1 billion. Microsoft subsequently absorbed Xandr into its Microsoft Ads platform in June 2023, retiring the brand entirely. The case stems from a 2020 complaint lodged by the Norwegian Consumer Council and Austrian privacy organization None of Your Business, which alleged the company shared personal data for commercial gain without explicit user permission.
According to the Data Protection Authority, "Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies." The regulator determined that Xandr held responsibility for securing user consent before handling the data, yet the company mistakenly assumed Grindr had already obtained proper authorization. "Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user," the authority stated. None of Your Business called the ruling "a major blow for the online advertising and commercial surveillance industry," noting that companies like Xandr are finally being held accountable.
The Norwegian decision signals regulators will hold advertising intermediaries responsible for privacy violations even when they function as middlemen in complicated programmatic advertising ecosystems. The ruling arrives amid heightened regulatory attention on data practices in digital advertising, with the Irish Data Protection Commission conducting multiple investigations into real-time bidding practices. The real-time bidding mechanism that powers much of online advertising depends on quick data sharing among numerous parties, frequently occurring without users' awareness or meaningful approval. Data protection authorities across Europe have increasingly focused enforcement efforts on the ad tech sector, and the Norwegian verdict may shape those proceedings while encouraging other national regulators to pursue comparable enforcement measures.
The penalty arrives alongside broader legal troubles for Grindr and the ad tech industry. Last month, Grindr settled a U.K. lawsuit for £26 million ($35.1 million) over allegations it shared users' HIV status and other sensitive details with third parties. Separately, a Texas federal judge granted final approval to a $177 million AT&T settlement addressing two 2024 data breaches that exposed Social Security numbers and call records for tens of millions of customers. AT&T originally created Xandr after buying AppNexus in June 2018, naming the unit after telephone inventor Alexander Graham Bell, before selling it to Microsoft three years later. Microsoft confirmed it's reviewing the decision and weighing its options, while Xandr has three weeks to file an appeal. For companies operating in the programmatic advertising chain, the ruling underscores that technical complexity won't shield them from accountability when user privacy is compromised. Intermediaries who once relied on plausible deniability about consent will now face direct scrutiny over whether they validated permissions before processing sensitive information.