Microsoft's Xandr fined NOK 92M by Norway over Grindr user data

Norway's data protection authority, Datatilsynet, has fined Microsoft's ad-tech business Xandr NOK 92M (about $9.6M) for handling personal data on Grindr (GRND) users without a lawful basis. It is the largest fine the regulator has ever issued. This time the target is not the dating app but the middleman that bought and sold its ad space.

The decision, dated 2 October and published on 12 October, finds that Xandr breached GDPR Articles 6(1) and 9(1) between July 2018 and April 2020. It processed the fact that people used Grindr, along with their advertising IDs and IP addresses, in real-time ad auctions. Because Grindr serves gay, bi, trans and queer people, simply being a user counts as data about sexual orientation.

The DII Take

The number matters less than the reasoning. Ad-tech's favourite defence, that the app collected consent, has now failed in Oslo. Datatilsynet has told every company in the ad chain to check consent for itself, and that a contract clause is no shield. That is fair, if slow: the original complaint is nearly seven years old, and dating operators should treat it as a warning about their own SDKs, not someone else's problem.

What Datatilsynet found

The case began with a complaint filed in January 2020 by the Norwegian Consumer Council, alongside privacy group noyb. Xandr, then called AppNexus, sat on both sides of the auction. As a supply-side platform it helped Grindr sell ad space, and as a demand-side platform it bid to buy that space for advertisers.

Ad requests reached Xandr directly from Grindr or through MoPub, the ad mediation SDK Grindr had built into its app. MoPub listed more than 160 demand and mediation partners. Datatilsynet said user data could be passed to potentially thousands of companies without the user ever knowing.

Xandr argued that it believed Grindr had collected consent, and that its standard contract barred Grindr from sending sensitive data. The regulator rejected both points. It found Xandr was a joint controller with Grindr, that the consents Grindr gathered were invalid, and that Xandr did nothing to check them. Director General Line Coll said "responsibility for data protection cannot be passed on to others".

The fine was set on Xandr's own turnover, not Microsoft's, because Microsoft only bought Xandr in June 2022. Datatilsynet counted the long handling time in Xandr's favour. Xandr has three weeks from receipt to appeal. If the regulator stands by its decision, the appeal goes to Norway's Privacy Appeals Board.

Microsoft's response and the Grindr precedent

Microsoft told Reuters that the case concerns conduct from before it bought Xandr, and that legal standards have moved on since. "We are reviewing the decision and assessing our options," a spokesperson said. Microsoft has already stepped back from ad buying: it stopped supporting media buying through its Microsoft Invest DSP on 28 February 2026. It said it would keep investing in Monetize, its platform for publishers.

Grindr has already paid for its side of the same data flows. Datatilsynet fined the app NOK 65M in December 2021, and the Privacy Appeals Board, Oslo District Court and Borgarting Court of Appeal all upheld it, the last on 21 October 2025. Grindr's latest quarterly filing says it paid the principal, about $6.5M, in February 2026, and is disputing a further NOK 16.8M (about $1.7M) in interest added by Norway's collection agency.

What it means for ad-funded dating apps

Any dating app that funds a free tier with programmatic ads sends user data through SDKs to companies its members never see. This decision shows liability runs in both directions along that chain. Grindr paid as the publisher. Xandr is now paying as the intermediary that bought and sold the inventory.

Expect ad partners to ask operators for firmer proof of consent, or to quietly stop bidding on sensitive inventory. Either outcome squeezes ad yield for niche apps.

Ad-tech's favourite defence, that the app collected consent, has now failed in Oslo.

The SDK detail deserves attention from every product team. MoPub's own documentation said it shortened IP addresses for users in the EU and EEA. Testing commissioned by the Norwegian Consumer Council found the SDK sending the full address to Xandr. Vendor paperwork is not evidence, so operators need to test what actually leaves the device.

Exposure is highest for apps whose name alone reveals a protected trait, such as sexuality or religion. The regulator leaned on EU court rulings that read sensitive data broadly, including data that only hints at such a trait. It found explicit consent was the only legal route open. For those apps, contextual ads that carry no personal data look like the safer bet.

Sources: Datatilsynet: Microsoft company fined NOK 92 million; Datatilsynet decision: Administrative fine, unlawful processing of personal data (PDF); Datatilsynet: The Court of Appeal upholds the fine against Grindr; Grindr Inc. Form 10-Q for the quarter ended 30 June 2026; Microsoft Advertising blog, May 2025; noyb: Norwegian Authority fines Microsoft's Xandr; Reuters: Norway fines Microsoft's Xandr $9.6 million over Grindr data sharing