Enforcement
Norwegian DPA Fines Xandr EUR 8.6 Million Over Grindr Real-Time Bidding Data
Datatilsynet fined the Microsoft-owned ad platform Xandr for sharing Grindr users' data, including inferred sexual orientation, through real-time bidding without a valid legal basis.
What happened?
Datatilsynet, Norway’s data protection authority, fined Xandr, an advertising technology company now owned by Microsoft, NOK 92 million (about EUR 8.6 million) in a decision dated 2 October 2026. Datatilsynet describes it as the highest fine it has issued to date. It announced the fine on 12 October 2026.
What did Xandr do?
Between July 2018 and April 2020, Xandr ran real-time bidding advertising auctions inside the dating app Grindr, acting on both the buy side and the sell side. Through those auctions, it passed on data about Grindr users, including the fact that a person used Grindr, their advertising ID and their IP address, to potentially thousands of other companies. Datatilsynet treated this as personal data revealing sexual orientation.
Why was this unlawful?
Datatilsynet found Xandr had no valid legal basis for the processing. Xandr argued it could rely on consent that Grindr had already collected from its users. Datatilsynet rejected that defence: it held Xandr was a joint controller with Grindr, and a joint controller must independently verify that consent is valid and actually covers its own processing, rather than relying on another party to have obtained it.
The fine is based on Xandr’s own annual turnover, not Microsoft’s, because Xandr was not part of Microsoft at the time. Datatilsynet treated the long duration of the practice and the direct financial benefit Xandr gained from it as aggravating factors, and says the amount was set to be effective, proportionate and dissuasive.
Can Xandr appeal?
Yes. Xandr has three weeks from receiving the decision to appeal it.
Why does it matter?
Real-time bidding chains routinely involve several companies handling the same personal data for different purposes. This decision is a reminder that sitting downstream of a publisher’s consent banner does not excuse a platform from checking that consent is actually valid for what it does with the data, particularly where the data can reveal something as sensitive as sexual orientation.
What should you do?
If you buy, sell or route data through programmatic advertising, map out who in the chain is relying on whose consent, and confirm that reliance is actually justified rather than assumed. See our GDPR guide.
What to watch
- Whether Xandr appeals, and how a Norwegian court or the EDPB treats the joint-controller reasoning if it does.
- Other real-time bidding and ad-tech cases testing whether buy-side and sell-side platforms can rely on a publisher's or app's own consent collection.
- Your own role in programmatic advertising chains. If you sit on either side of a real-time bidding auction, check who is relying on whose consent, and whether that is actually enough under GDPR Articles 6 and 9.
Sources and official references
- Microsoft company fined NOK 92 million for unlawfully sharing personal data — Datatilsynet (Norwegian Data Protection Authority) (official source)
- Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data — European Data Protection Board (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
