Business · Companies · 3 hrs ago
Norway fines Microsoft-owned Xandr $9.6 million over Grindr user data
Norway’s Data Protection Authority fined Xandr, an advertising company owned by Microsoft, 92 million kroner, or $9.6 million.
The authority said Xandr unlawfully handled and shared sensitive information about Grindr users, including data about sexual orientation.
Grindr is a location-based dating app that primarily serves the LGBTQ+ community.
From July 2018 to April 2020, Xandr ran ad auctions that could expose users’ profiling information to thousands of companies.
The authority said Xandr relied on Grindr’s consent but did not check whether it was valid or establish a legal basis for its own data use.
It called the penalty the largest it has issued, and said users’ sensitive data was shared without their explicit consent.
Xandr has three weeks to appeal, while Microsoft says it is reviewing the decision and notes that the conduct predates its acquisition of Xandr.
Norway’s Data Protection Authority fined Microsoft-owned advertising company Xandr NOK 92 million, or $9.6 million, over its handling of Grindr users’ data.
The authority said Xandr unlawfully processed and shared sensitive information, potentially including users’ sexual orientation, without verifying valid consent.
The processing took place between July 2018 and April 2020 through real-time advertising auctions on Grindr.
The authority called the penalty the largest fine it has ever issued.
Xandr, now operating as Microsoft Advertising, has three weeks to appeal and is reviewing the decision.
- Who
- Norway’s Data Protection Authority fined Xandr, a Microsoft-owned advertising company.
- What
- Xandr was fined NOK 92 million for unlawfully processing and sharing sensitive Grindr user data.
- When
- The data processing occurred between July 2018 and April 2020. The fine was reported on October 12, 2026.
- Where
- Norway; the data at issue included information about Grindr users in Norway and other countries.
- Why
- The authority said Xandr did not verify that Grindr users had given valid consent or ensure a legal basis for its own processing.
Norway’s Data Protection Authority
Xandr/Microsoft
Consent
Norway’s Data Protection Authority
The authority said Xandr failed to verify that Grindr users’ consent was valid or establish a legal basis for its processing.
Xandr/Microsoft
Microsoft said the investigation concerned conduct that predated its acquisition of Xandr.
Penalty and response
Norway’s Data Protection Authority
The authority issued a fine of NOK 92 million, which it said was its largest ever.
Xandr/Microsoft
Microsoft said it was reviewing the decision and assessing its options.
Noyb and the Norwegian Consumer Council filed the original complaint.
Xandr managed real-time advertising auctions on Grindr that potentially exposed users’ data to thousands of companies.
BleepingComputer reported that Norway’s Data Protection Authority had fined Xandr NOK 92 million.
Xandr was given three weeks to appeal, and Microsoft said it was reviewing the decision.
- Fine
- NOK 92 million ($9.6 million)
- Company
- Xandr, a Microsoft-owned advertising company now operating as Microsoft Advertising
- Authority
- Norway’s Data Protection Authority (Datatilsynet)
- Data processing period
- July 2018–April 2020
- Complaint filed
- January 2020 by Noyb and the Norwegian Consumer Council
What people are saying
We issued such a high fine in this case because the breaches we identified were very serious
Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.
focused on conduct that predates Microsoft's acquisition of Xandr
reviewing the decision and assessing our options.
Sources
Related news
Singapore’s central bank likely to tighten policy again
Iran says oil intermediaries owe the government up to $12bn
H&M investigates claims of cyberattack by group linked to JLR hack
Riga Black Balsam producer faces decision on possible insolvency
Gulf Air tops Middle East and Africa for on-time arrivals in September
Genting shares fall most since 1998 after fundraising plan
Banque du Caire to offer 30% stake in Egypt IPO
Global debt tools face another test in Senegal
M-KOPA extends pay-as-you-go financing to electric tuk-tuks in Kenya
Singapore proposes a regulatory label for stablecoins
Monopulse raises over €2 million to expand drone production
