Norway Hands Record Privacy Fine to Microsoft Adtech Unit Over Grindr Data
Norway’s data protection authority has fined Microsoft-owned advertising technology company Xandr NOK 92 million, or roughly €8.6 million, for processing Grindr users’ personal data without a valid legal basis. The regulator said the data included information that could reveal sexual orientation, and that Xandr did not properly verify explicit consent. The penalty, described as the agency’s largest administrative fine to date, follows complaints from 2020 by the Norwegian Consumer Council and noyb.
Norway’s data protection regulator imposed its largest administrative penalty so far on Xandr, a Microsoft-owned adtech business once known as AppNexus. The matter traces to 2020 complaints from the Norwegian Consumer Council and noyb.
Regulators found Grindr users’ details flowed through automated ad auctions, potentially reaching numerous market participants. Since identifying someone as a Grindr user can signal sexual orientation, explicit permission was needed. Xandr and Grindr were treated as joint controllers; the unlawful processing ran from July 2018 to April 2020. Xandr has three weeks to appeal.
This ruling may push adtech intermediaries to independently verify consent instead of trusting app providers. It could affect advertisers, platforms, and users of sensitive apps, particularly LGBTQ+ people, who may gain stronger safeguards over intimate data. Compliance burdens might rise for smaller adtech firms, while regulators could cite the case in future enforcement. The appeal may clarify how joint-controller duties apply across automated advertising chains.