Norway Grindr data fine is record 92m kroner, Xandr can appeal

The fine is for processing and sharing Grindr users’ sensitive data without a valid legal basis. The regulator says Xandr took part in real-time bidding inside Grindr, acting for both the buyers and the sellers of ad space. In plain terms, real-time bidding is an instant auction: when you open an app, information about you goes out, advertisers bid for the right to show you an ad, and the winner’s ad appears, all in a fraction of a second.

According to Datatilsynet, Xandr was jointly responsible with Grindr for how that data was used. That meant Xandr itself needed explicit consent from users. Instead, the regulator says, it took for granted that Grindr had collected valid consent and never checked. Line Coll, the authority’s director general, said Xandr did nothing to make sure it had a legal basis for its own processing.

The breaches ran from July 2018 to April 2020. The regulator says thousands of people in Norway had their sensitive data shared unlawfully, and that users in other countries were affected too. Coll described the breaches as very serious, which is why the penalty was set so high.

Here’s the twist: Microsoft didn’t own Xandr when any of this happened. AT&T created Xandr after it bought the ad company AppNexus in June 2018, naming it after Alexander Graham Bell. Microsoft bought it in late December 2021 and folded the brand into Microsoft Advertising in June 2023.

The regulator says it worked out the fine from Xandr’s total annual turnover during the period of the breaches, which predates Microsoft’s purchase. A Microsoft spokesperson stressed that the case covers conduct from before the acquisition, said laws and how they are enforced have changed since then, and said the company is reviewing the decision and assessing its options. Xandr was given three weeks to appeal.

The case started with a complaint filed in January 2020 by the Norwegian Consumer Council and noyb, an Austrian privacy group run by activist lawyers. They argued that Xandr shared Grindr users’ personal data for commercial purposes without permission. It took more than six years for the decision to land.

Both groups welcomed the result. Mette Fossum, a director at the Consumer Council, said none of Grindr’s users had any relationship with Xandr or any reason to think their data would reach it. She went further, saying it is hard to see how surveillance-based advertising can be lawful at all if consent has to be informed and meaningful. Felix Mikolasch, a data protection lawyer at noyb, said adtech companies usually work in the background and rarely face consequences, and that this ruling sets a useful precedent.

Grindr has its own history here. Norway’s regulator earlier fined the dating app 65 million kroner over the same kind of data sharing, and the country’s Court of Appeal upheld that decision in 2025. In September, Grindr agreed to pay £26 million to settle a lawsuit in the UK over claims that it shared users’ personal details, including HIV status, with third parties.

For most people in the US, UK and Canada, the practical lesson is that the ads in free apps are often paid for with your data, and that data can travel far beyond the app you chose to use. You agree to an app’s terms. You usually never hear of the ad companies that receive your details next.

The Norwegian ruling says those companies have their own duty to check that you agreed, especially when the data reveals something as personal as sexual orientation or health. That matters well beyond Norway, because European privacy rules apply to any company handling data about people in Europe, and big ad platforms tend to change their systems globally rather than country by country.

You can also cut down how much you feed these auctions today:

• On an iPhone, keep “Allow Apps to Request to Track” switched off in the privacy settings, or tap “Ask App Not to Track” when an app asks.
• On Android, delete your advertising ID in the Google privacy settings so apps can’t link your activity to one profile.
• Check which apps have location access and set sensitive apps, such as dating or health apps, to share location only while you use them.

Microsoft’s three-week window to appeal was set when the decision came out in mid-October, so it runs into early November. No appeal had been announced in the reports we checked. If Microsoft does challenge it, the fight could drag on for years, as Grindr’s own fine did before the Court of Appeal settled it. Either way, noyb is already pointing to the decision as a precedent for similar complaints against ad companies.