Microsoft Xandr Fine Over Grindr User Data

The Microsoft Xandr fine has put advertising data privacy back in the spotlight after Norway fined Microsoft-owned advertising technology company Xandr NOK 92 million (approximately $9.6 million) over the unlawful processing and sharing of personal data linked to Grindr users. The Norwegian Data Protection Authority announced the decision on October 12, 2026, stating that Xandr processed sensitive personal data without a valid legal basis.

The decision is important for the digital advertising industry because it focuses on a company operating behind the scenes of online advertising. Many users know the app they open, but they may not know which advertising companies receive information about them when an ad is selected. Norway’s regulator says companies involved in that process cannot avoid their own responsibilities by assuming that another company has already obtained consent.

The Microsoft Xandr fine follows a complaint made in 2020 by the Norwegian Consumer Council, working with the European privacy organisation noyb. The regulator’s official announcement confirms the amount and explains why the company was held responsible. Reuters also reported the decision on October 12, making this a current development rather than a newly written summary of an older announcement.

Why Norway Fined Microsoft’s Xandr

The case concerns data connected to people using Grindr in Norway. According to the regulator, Xandr processed and passed personal data to potentially thousands of companies through the online advertising system. Some of the information could reveal that a person was using Grindr, which the authority treated as information concerning sexual orientation.

That detail matters because information about sexual orientation receives special protection under the General Data Protection Regulation, commonly known as the GDPR. The regulator concluded that explicit consent was required for this processing, but Xandr had not taken the necessary steps to check that valid consent existed.

The authority also found that Xandr was jointly responsible with Grindr for the relevant data processing. In simple terms, Xandr could not rely only on the idea that Grindr was responsible for obtaining permission from users. It had to make sure that its own handling of the information had a proper legal basis.

The regulator’s position is that privacy duties do not disappear when several companies work together. If an advertising business receives or uses personal information, it must understand what it is processing and establish whether the processing is lawful. This is one of the main reasons the Microsoft Xandr fine could matter beyond this single case.

How Grindr User Data Entered The Advertising System

To understand the case, it helps to know how automated advertising works. When someone opens an app that contains advertising space, the app may send an ad request to an advertising platform. The request can contain information such as a device advertising identifier, an IP address and details that identify the app where the ad will appear.

That request may enter a process known as real-time bidding. Advertising platforms can send information about an available ad placement to potential buyers, who automatically decide whether to bid. The process happens very quickly, often in a fraction of a second, and the winning advertiser gets the opportunity to display an ad.

Real-time bidding is widely used in digital advertising because it allows advertisers to compete for impressions and helps publishers earn revenue from their content or services. However, the system can also create privacy risks when personal information travels through a long chain of companies that ordinary users cannot easily identify. In this case, the Norwegian regulator said Xandr acted on both the buying and selling sides of the advertising process. Information associated with Grindr users could therefore be passed through the advertising ecosystem as part of automated ad transactions. The concern was not simply that an ad was shown, but that sensitive information was processed without the required legal basis.

The authority also explained that knowing someone uses Grindr can itself reveal information about sexual orientation. A company does not necessarily need to receive a direct statement about a person’s identity for data to be sensitive. The context in which information is collected and the conclusions that can be drawn from it can also matter.

Why Xandr Could Not Rely Only On Grindr’s Consent

One of the central issues was consent. Xandr’s position, as described by the regulator, was that it believed Grindr had obtained users’ consent. The authority rejected the idea that this assumption was enough to meet Xandr’s own legal duties.

For users, consent is meaningful only when they can understand what they are agreeing to and when the permission actually covers the relevant processing. A person might accept an app’s terms without understanding that information connected to app use could be passed to advertising companies they have never heard of.

For advertising businesses, this creates a practical compliance responsibility. Companies need to understand what data they receive, why they process it, which parties may receive it next and what legal basis allows the activity. They should also keep evidence that supports their compliance decisions rather than relying on broad assurances from partners.

The regulator said Xandr had not verified that the consent collected by Grindr was valid for its own processing. It also concluded that Xandr and Grindr were joint controllers in the relevant activity. That finding is significant because it makes clear that more than one business can have responsibility for the same data-processing operation. The Norwegian Consumer Council’s announcement provides additional background on the complaint and the wider concerns about personal information moving through advertising systems.

The Fine Covers Activity From 2018 To 2020

Although the announcement is new, the conduct at the centre of the case is not recent. The regulator said the infringements took place from July 2018 to April 2020, covering almost two years. The complaint that started the investigation was filed in January 2020. The timing is also important for understanding Microsoft's role. Microsoft acquired Xandr in June 2022, after the period covered by the regulator’s findings. The authority said it calculated the fine using Xandr’s own annual turnover rather than Microsoft’s turnover because Xandr was not part of Microsoft during the relevant period.

The regulator described NOK 92 million as the largest fine it has issued to date. It said the seriousness and length of the infringements, along with the company’s position in the advertising technology sector and the financial benefit connected to the unlawful sharing, were relevant to the amount.

The fine is imposed in Norwegian kroner, so that is the clearest figure to use when reporting the decision. The regulator gives an approximate euro equivalent of €8.6 million, while noyb describes it as about €8.5 million. These are currency conversions, not different fine amounts.

Xandr has three weeks from receiving the decision to appeal. The announcement does not establish that the decision has become final after all possible legal challenges, so the appeal process remains an important point to watch.

Microsoft Says It Is Reviewing The Decision

Microsoft told Reuters that protecting users’ privacy is a priority. The company also said the investigation and decision concerned conduct from before its acquisition of Xandr, when the interpretation and application of legal standards and practices were different. It said it was reviewing the decision and assessing its options. That response is relevant because the fine concerns historical activity rather than a finding that the same conduct is currently taking place. The decision should therefore be understood within the period and facts examined by the regulator.

At the same time, the case raises a wider question for companies that use advertising technology: how can they show that the data entering their systems has been collected and shared lawfully? It is not enough to assume that another company in the chain has already checked everything. The full decision may also matter to businesses reviewing their own data practices. Advertising platforms, publishers, app developers and advertisers can all have different roles in a transaction. Those roles should be clearly understood, and contracts should not be treated as a replacement for checking actual data flows and legal responsibilities.

What The Microsoft Xandr Fine Means For The Adtech Industry

The immediate result is a major financial penalty for Xandr, but the wider message is about accountability. Digital advertising often depends on information moving between many businesses in a short time. This can make the system difficult for users to understand and can make responsibility less clear when something goes wrong. The Norway decision signals that advertising intermediaries may face consequences if they process sensitive information without checking the legal basis for doing so. Companies should not assume that data is safe to use simply because it arrives through an established advertising partner or a standard technical connection.

For marketers and advertising teams, privacy compliance should be considered alongside campaign performance. A campaign may be designed to reach the right audience, but the methods used to select that audience still need to follow applicable rules. Data minimisation, careful vendor checks, clear consent records and regular reviews of data flows can help reduce risk.

This is also relevant to businesses using native advertising and other forms of paid traffic. AdScaleLab readers can explore our guides to native advertising budgets, Taboola and Outbrain for more on the advertising platforms and decisions that shape campaigns. These resources cover different aspects of advertising, while the Xandr case highlights why privacy and compliance should remain part of the wider discussion.

The case does not mean that all real-time bidding or targeted advertising is automatically unlawful. The central issue is whether the particular processing has a valid legal basis and meets the rules that apply to the information involved. Businesses should review their own circumstances rather than assume that the ruling applies in exactly the same way to every advertising setup.

What Happens Next?

The next major development will be whether Xandr appeals the decision. The regulator has given the company three weeks from receipt of the decision to do so. An appeal could lead to further legal review, so the outcome should be followed before treating every part of the decision as settled.

For now, the regulator’s announcement provides a clear message to the advertising technology sector: companies must take responsibility for the personal data they process. Consent and compliance cannot simply be passed from one company to another without verification. The Microsoft Xandr fine also shows why privacy risks in advertising are not limited to the apps people use directly. Information can move through systems that remain largely invisible to users, making it important for every business in the chain to understand its role.

As regulators continue to examine how online advertising works, companies will need to show not only that their technology delivers ads effectively, but also that the data used to deliver those ads is handled lawfully. The Xandr case is a fresh reminder that performance and privacy must go together.