Norway’s data protection authority has fined Microsoft’s adtech unit Xandr 92 million crowns for sharing sensitive Grindr user data with advertisers without consent.
Norway’s data protection authority, Datatilsynet, has imposed a fine of 92 million crowns ($9.61 million) on Microsoft’s advertising technology unit, Xandr. The penalty, announced on Monday, marks the largest fine the Norwegian regulator has ever issued. The authority found that Xandr unlawfully relayed sensitive data from users of the dating app Grindr to thousands of advertisers between July 2018 and April 2020.
The case centers on the use of real-time bidding, a process where ad space is sold in milliseconds as a user opens an app. According to Datatilsynet, when users in Norway launched Grindr, their personal data was sent through Xandr and potentially shared with numerous companies in the advertising industry. Because Grindr serves gay, bisexual, trans, and queer users, the regulator determined that app usage alone could reveal a person’s sexual orientation. Under European data protection rules, this constitutes sensitive data requiring explicit consent for processing.
Xandr argued that it assumed Grindr had obtained valid consent from its users and did not independently verify this. The regulator rejected this defense, ruling that Xandr shared legal responsibility with Grindr for the data breaches. Datatilsynet Director General Line Coll stated, "Responsibility for data protection cannot be delegated to others," emphasizing that each company must independently ensure it has a legal basis for using the data it procures.
Microsoft stated that the privacy of users is a top priority. In a statement, the company noted, "This investigation and decision focused on conduct that predates Microsoft’s acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing the decision and assessing our options."
The fine was calculated based on Xandr’s revenue rather than Microsoft’s, as Microsoft did not own the unit at the time of the breaches. Xandr has three weeks to appeal the decision. This ruling follows a 2021 fine of 65 million crowns against Grindr for similar breaches, which was upheld by Norwegian courts in 2025.
The case originated from a 2020 complaint filed by the Norwegian Consumer Council and the Austrian privacy organization noyb. Felix Mikolasch, a data protection lawyer at noyb, described the ruling as an important precedent that could force greater accountability from adtech firms. Finn Myrstad, director of digital policy at the Norwegian Consumer Council, said the decision puts companies relying on user tracking on notice.
The decision aligns with a recent ruling in France, where the Conseil d’Etat upheld a €40 million fine against retargeting company Criteo, also rejecting the claim that partner websites were solely responsible for collecting consent. These cases collectively establish that adtech intermediaries cannot pass the blame for privacy violations to the apps from which they purchase data.
This ruling reinforces the principle that data protection responsibilities cannot be outsourced or delegated within the advertising supply chain. By holding Xandr accountable for data it did not directly collect, Norwegian regulators are signaling that adtech intermediaries must actively verify consent and legal bases for processing sensitive user information. This sets a significant precedent for how global adtech companies operate in Europe, potentially requiring more rigorous compliance checks for data acquired from third-party apps.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
Quantum computing company IonQ announced Monday it will acquire zero-trust cybersecurity firm Elisity in an all-stock deal valued at up to $1.3 billion. The acquisition aims to combine post-quantum cryptography with network access controls.
TechTrending
Google has launched the Fitbit Edge, a new fitness tracker priced at $179.99. The device features a slim design, built-in GPS, and up to seven days of battery life, positioning itself between the Fitbit Air and Pixel Watch 5.
