Norway issued its largest privacy fine over ad auctions that carried Grindr users’ orientation data

Norway’s data protection authority, Datatilsynet, has fined the Microsoft-owned advertising company Xandr NOK 92 million, about $9.6 million. The regulator says it is the largest fine it has ever issued. The penalty was reported on October 12, 2026, and concerns data that flowed from the dating app Grindr to advertisers between July 2018 and April 2020.

The regulator’s finding is that sensitive information about users, including their sexual orientation, reached the advertising market without valid consent. The fine falls on Xandr alone, not on Grindr, and Microsoft says the matter is still under review.

Datatilsynet’s decision and the NOK 92 million penalty

Datatilsynet’s Director General, Line Coll, in the authority’s news release, explained the size of the penalty by saying the breaches the authority identified were very serious, and that thousands of users in Norway had been subjected to unlawful sharing of their sensitive data. According to the BleepingComputer report, the fine runs to NOK 92 million, and the Austrian privacy group noyb converts it to 8.5 million euros. The two dollar and euro figures differ only because of exchange rates; the krone amount is the one the authority set. The NOK 92 million penalty is, the regulator says, the largest fine it has ever issued.

The regulator treats the case as one about responsibility rather than about a hack. No outsider broke into anything. The finding is that data users handed to one app was passed along a commercial chain, and that the company in the middle did not check whether the permission at the start of the chain was real.

Real-time ad auctions as the channel for orientation data

Xandr ran real-time advertising auctions inside Grindr. In an auction of that kind, an advertiser bids for the right to show an ad to a particular user in the moment the app loads, and to decide what to bid it needs details about that user. Xandr acted as the intermediary: advertisers received profiling information from it, and the exposed material included users’ sexual orientation. The report says that information could reach thousands of companies that took part in the auctions, without users realising it or giving explicit consent.

Under European data-protection law, information about a person’s sex life or sexual orientation is a special category of data. The processing of such data is prohibited by default and allowed only on narrow grounds, the most relevant here being explicit consent. The text is in the General Data Protection Regulation, and the Norwegian decision treats the auction traffic as falling inside that protected category. That is the regulator’s characterisation of the data practice, not a statement about any individual who used the app.

A bid request is a small message, but it can carry a great deal. Once such a message reaches many bidders, the sender has little practical control over what each recipient keeps. That structure is why the Norwegian case turned on consent at the start of the chain rather than on what any single bidder later did.

The legal basis for the penalty

The stated ground for the fine is that Xandr, as a joint controller with Grindr, was responsible for how the data was used and should have required and obtained explicit consent. Coll said that Xandr “omitted to verify that the consents from Grindr were valid.” According to the BleepingComputer report, Xandr assumed the app had gathered valid consent and did not confirm it. In other words, the company did not need to have collected the data itself to be liable for what it did with it.

The coverage available does not name the specific articles of the regulation the authority applied, and the decision text was not available for this report. What noyb says is that Xandr processed personal data, including data on sexual orientation, without a valid legal basis. Felix Mikolasch, a data protection lawyer at noyb, said the group very much welcomed the decision. That is a complainant’s reading, and the authority’s own release is the document that sets out the reasoning in full.

Appeal history and what remains open

Xandr was given three weeks to appeal, and the reports do not confirm whether an appeal has been filed. A Microsoft spokesperson said the investigation focused on conduct that predates Microsoft’s acquisition of Xandr and that the company is reviewing the decision and assessing its options. That is a statement of review, not an admission, and the fine should be read as announced rather than as final until the appeal window closes or a challenge is resolved.

The case has a long paper trail. The Norwegian Consumer Council, Forbrukerrådet, and noyb filed the original complaints on 14 January 2020, naming Grindr and several advertising companies, among them AppNexus, OpenX, Smaato and AdColony. A banner on the Council’s page reports that a court of appeal later ruled Grindr had violated the regulation and upheld a NOK 65 million fine against the app itself, dated October 25, 2025. The Xandr fine is larger than that NOK 65 million figure, though the banner does not say that the two penalties stem from the same complaint.

Finn Myrstad, the Council’s director of digital policy, said the decision sends a powerful signal to everyone whose business model depends on tracking and profiling consumers. Whether that holds will depend on how the appeal route plays out, and on whether the amount survives it. For now the record shows an announced fine, a company reviewing its options, and a regulator that has put a number on what an ad auction can pass along when consent is assumed rather than checked.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview