Norway imposes €8.6 million fine on Xandr over Grindr data

Norway issues record privacy penalty

The Norwegian Data Protection Authority has fined Xandr €8.6 million ($9.62 million) for illegally relaying Grindr users’ sensitive personal data to advertisers. The regulator described the administrative penalty as its largest to date and said the seriousness of the infringement justified the amount.

The case concerns processing between July 2018 and April 2020. Xandr acted as an intermediary for data associated with Grindr users in Norway, including information that could reveal their sexual orientation, the authority said. It estimated that the data could have been passed to potentially thousands of companies.

The authority concluded that Xandr was a joint controller with Grindr. That status meant Xandr had its own responsibility to secure valid consent before processing the information, rather than relying on an assumption that the dating app had obtained the necessary consent.

Real-time bidding at the centre of the finding

The regulator said the core conduct involved real-time bidding, with Xandr operating on both the buying and selling sides of the advertising process. When an individual opened Grindr, personal data was in many instances relayed through Xandr to participants in the advertising ecosystem.

Those participants could bid to serve targeted advertising, while the exchange remained hidden from the person using the app. The complaint that led to the case was filed in 2020 by the Norwegian Consumer Council and the Austrian privacy organisation noyb. It alleged that users’ personal data had been shared for commercial purposes without explicit consent.

The DPA said thousands of users in Norway were affected by the unlawful sharing. It calculated the fine using Xandr’s total annual turnover during the two-year period at issue, which was before Microsoft acquired the company.

Ownership changed, but the appeal window remains open

Xandr was created by AT&T after its June 2018 acquisition of AppNexus. Microsoft acquired Xandr in late December 2021, and the Xandr brand was retired and consolidated under Microsoft Ads in June 2023.

Xandr has three weeks to appeal the decision. Microsoft told Reuters that it was reviewing the ruling and assessing its options. noyb called the decision a major blow to online advertising and commercial surveillance.

The ruling follows Grindr’s decision last month to pay £26 million ($35.1 million) to settle a UK lawsuit over allegations that it shared users’ personal information, including HIV status, with third parties. For businesses using advertising technology, the practical implication is that sensitive-data processing requires demonstrable consent, clearly assigned controller responsibilities and visibility into every recipient in a bidding flow.