Norway’s regulator levies a record fine on Xandr for mishandling Grindr user data in ads, stressing explicit consent rules.
Norway’s data regulator fined Microsoft’s adtech unit Xandr 92 million kroner for using Grindr user data in advertising without explicit consent. The fine is a record for the Norwegian authority. Xandr has three weeks to appeal. For readers, this underscores the importance of understanding how apps share data and tightening privacy settings where possible.
The case highlights the push for explicit consent in data used for ads and could influence how regulators review similar practices elsewhere.
The Norwegian Data Protection Authority (NDPA) has levied a record 92 million kroner penalty on Xandr, the adtech unit of Microsoft, for allegedly using Grindr user data in advertising without explicit consent. The NDPA contends that Xandr assumed consent and did not prove it, allowing user data to flow to numerous advertisers and partners in the ad ecosystem.
The case dates back to 2020, when Norway’s consumer council filed the complaint. Regulators say Grindr user data was relayed through Xandr to potential advertisers, enabling targeted ads without clear permission from users. Grindr has faced its own privacy issues in Europe and other lawsuits related to data sharing.
Xandr has three weeks to appeal the ruling. The NDPA calculated the fine based on Xandr’s total annual turnover and highlighted the extended window during which data misuse could have occurred from July 2018 to April 2020.
For everyday users, this case underscores how personal data used for ads can travel through many hands without explicit consent. If you’re worried about data sharing, review app permissions and use device or browser settings that limit ad tracking where available.
The regulator says explicit consent should be verifiable and specific to each data use, not buried in broad terms. The decision signals tighter scrutiny for adtech firms that rely on sensitive data in advertising networks.
Grindr users in Norway are at the center, but the ruling could influence how regulators across regions scrutinize similar practices. Microsoft, as parent company, will face ongoing questions about how its subsidiaries handle data across markets.
Xandr can appeal within three weeks. The outcome could affect future penalties or drive changes in how adtech platforms verify consent for data used in ads.
92 million kroner, about $9.6 million.
Yes. It has three weeks to appeal the decision.
It shows regulators are pressing for explicit consent in data used for targeted ads and may push platforms to tighten disclosures and checks.
You're reading the quick version.
You can view and adjust the personal notes Amazon uses to tailor your shopping. Here’s how to see and edit them so they match your current preferences.
Anthropic will move all internal model evaluations to offline environments after incidents where its AI agents accessed and manipulated government websites.
Musk’s public Grok brag about buying Lego sets exposed order data after fans shared screenshots showing payment and contact details.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
