Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Compliance

Norway Fines Xandr a Record €8.6M for Relaying Grindr Users' Sensitive Data

Norway's data protection authority found that Microsoft-owned Xandr passed Grindr users' data, including data revealing sexual orientation, to advertisers through real-time bidding without a valid legal basis. It is the authority's largest fine to date.

4T4Tify Team4Tify
Oct 13, 2026·4 min read
Norway Fines Xandr a Record €8.6M for Relaying Grindr Users' Sensitive Data

Norway Fines Xandr a Record €8.6M Over Grindr Data in Ad Auctions

Norway's data protection authority, Datatilsynet, has fined Xandr (the ad-tech business AT&T built and later sold to Microsoft) €8.6 million (about $9.6 million) for passing on personal data from Grindr users to advertisers. That data included information that reveals a user's sexual orientation. The regulator says this is the largest administrative penalty it has ever issued, and it called the breach "very serious".

What happened

  • The period: the infringements ran from July 2018 to April 2020.
  • The mechanism: Xandr sat on both the buyer and the seller side of real-time bidding (RTB). When someone opened the Grindr app, their personal data could be sent through Xandr to potentially thousands of companies in the ad ecosystem. Those companies then bid against each other to show targeted ads, and the user could not see any of it.
  • The legal finding: the regulator found that Xandr was a joint controller with Grindr. That made Xandr responsible for having a valid legal basis, including consent, before it processed the data. Xandr argued that it had assumed Grindr collected consent. The regulator rejected that defence.
  • How the case started: in 2020 the Norwegian Consumer Council and the Austrian privacy group noyb filed a complaint. They alleged that users' data was being shared for commercial purposes without explicit consent.
  • How the fine was set: it was based on Xandr's total annual turnover during the infringement period, which was before Microsoft acquired it. Xandr has three weeks to appeal. Microsoft says it is reviewing the decision.

Why it matters

This case is about more than one ad platform. It shows four things:

  1. Being an intermediary doesn't protect you. If your platform decides how and why personal data moves, regulators can treat you as a joint controller, even if you never collected the data yourself.
  2. "Our partner got consent" is not a defence. Each controller must be able to show its own legal basis.
  3. Special-category data carries the biggest penalties. Under GDPR Article 9, data that reveals sexual orientation, health, or similar traits brings heavier scrutiny and larger fines.
  4. Liability survives acquisitions. The conduct happened under AT&T's ownership, but the decision came years later and after a sale. When you buy a company, you also inherit its historical data-handling risk.

What to do

  • Map your data flows to third parties. List every SDK, ad network, analytics tool, and data broker in your web and mobile apps, along with the exact fields each one receives.
  • Classify sensitive signals. Flag any data point that could reveal special-category information. That includes app identity on its own: knowing that someone uses a dating, health, or religious app can be enough. Stop sending this data into RTB or bidstream pipelines unless you have explicit, documented consent.
  • Review controller and processor roles. Look again at your ad-tech and data-sharing contracts. Where you decide the purpose or the means of processing, assume joint controllership and document your own legal basis.
  • Check consent with evidence. Test what your consent management platform actually sends before and after a user declines. Don't rely only on what your vendors tell you.
  • Include privacy in M&A due diligence. Ask targets for data flow inventories, records of regulatory complaints, and evidence of consent before closing a deal.
  • Plan for a regulator's questions. Keep a records-of-processing register and DPIAs that let you show quickly who receives which data, and why.

Our assessments flag uncontrolled third-party scripts, tracking SDKs, and data that leaks to external domains. These are often the technical starting point for exactly this kind of compliance exposure.

Originally reported by The Hacker News. Summarized and analyzed by the 4Tify Team.

SHARE