Norway's Datatilsynet makes NOK 92m Xandr fine final over Grindr data

Norway’s Data Protection Authority (Datatilsynet) has made its NOK 92m (€8.6m) administrative fine against Xandr final after the advertising company did not appeal, the authority said in an update on 3 November 2026. It is Datatilsynet’s highest fine to date. Xandr, formerly AppNexus and now part of Microsoft, processed and shared Grindr users’ personal data without a lawful basis between July 2018 and April 2020.

The compliance point is direct: each company involved in a data-sharing chain must establish and document that its own processing is lawful. Datatilsynet rejected Xandr’s position that it could rely on Grindr having obtained user consent, and found Xandr was a joint controller with Grindr. The final decision exposes ad-tech firms that pass sensitive data through real-time bidding without independently verifying consent or another legal basis.

What Datatilsynet found

When a user opened Grindr, Xandr in many cases relayed the person’s data through the real-time bidding ecosystem. Potentially thousands of companies could then receive the information and bid to show targeted advertising, without the user knowing.

Grindr is a location-based dating app aimed at gay, bisexual, transgender and queer people. Datatilsynet said that being a Grindr user is itself information indicating sexual orientation, which receives special protection under data protection law. The authority concluded that explicit consent was required, but Xandr had not checked whether Grindr’s consents were valid or otherwise ensured that it had a legal basis for its own processing.

Xandr participated on both the buyer and seller sides of the advertising transactions. Datatilsynet’s director general, Line Coll, said the company could not assume consent was someone else’s responsibility:

“Responsibility for data protection cannot be passed on to others.”

The authority also said the case showed how opaque the advertising ecosystem is for individuals. Once shared, the data could be combined with other information to create a detailed picture of a person’s life.

Why the penalty reached NOK 92m

Datatilsynet said the amount had to be effective, proportionate and dissuasive for Xandr and other businesses. It treated Xandr’s position as a large, leading ad-tech company as significant because processing personal data is central to its business model. The company also obtained a direct financial benefit from the unlawful sharing.

The practice continued for almost two years, which Datatilsynet treated as an aggravating factor. The authority calculated the fine using Xandr’s own total annual turnover, rather than Microsoft’s, because Xandr was not part of Microsoft during the period covered by the decision.

The case began in 2020 after the Norwegian Consumer Council complained about Xandr, then AppNexus. Datatilsynet referred to the Borgarting Court of Appeal’s 2021 finding in a related Grindr case, which resulted in a NOK 65m fine for equivalent breaches. Xandr had three weeks from receiving the decision to appeal. Datatilsynet confirmed on 3 November that no appeal had been filed and that the decision was final.