Norwegian Regulator Hits Microsoft‑Owned Xandr With $9.6 Million Fine Over Grindr Data Misuse

Norway's data‑protection watchdog, Datatilsynet, imposed a fine of 92 million Norwegian kroner (about $9.6 million) on Xandr, the advertising arm owned by Microsoft, for unlawfully processing and sharing sensitive information belonging to users of the gay‑dating app Grindr.

The authority found that Xandr collected details such as users' sexual orientation, precise location, device identifiers and other personal markers, then passed the data on to third‑party advertisers without a lawful basis. Under the EU General Data Protection Regulation, which Norway enforces through its own legislation, the handling of such special‑category data requires explicit consent or a clear public interest justification—conditions the regulator says were not met.

Xandr, formerly known as AppNexus before its acquisition by Microsoft in 2021, provides programmatic advertising technology that matches ads to audiences in real time. Grindr, with millions of active users worldwide, has faced repeated scrutiny over how it safeguards the privacy of a community for whom anonymity can be a matter of safety. The Norwegian case adds to a growing list of investigations into how ad tech platforms treat data from dating services.

Datatilsynet described the breach as “serious and systemic,” noting that the unauthorized sharing exposed users to targeted marketing that could reveal intimate aspects of their lives. In a brief statement, the regulator said the penalty reflects the gravity of the violation and serves as a deterrent for other firms handling similar data. Xandr, for its part, acknowledged the investigation and said it is reviewing the findings while cooperating with the authority.

The ruling underscores the increasing willingness of European data‑protection agencies to enforce hefty penalties when companies fail to respect privacy safeguards. Analysts expect the decision will push ad‑tech firms to tighten consent mechanisms and audit data flows involving sensitive categories, especially in sectors such as dating, health and finance.

Legal experts note that Xandr may appeal the fine, a process that could extend the case for months. Regardless of the outcome, the fine sends a clear signal that even large, globally integrated tech subsidiaries are subject to national enforcement actions when they fall short of GDPR requirements. The episode also highlights the broader challenge of balancing lucrative targeted advertising with the fundamental privacy rights of users in an era of heightened regulatory scrutiny.