Grindr data passed to advertisers: Norway imposes record fine on Microsoft subsidiary

Norway's data protection authority Datatilsynet on Monday fined Xandr, a Microsoft subsidiary, 92 million kroner (about 8.6 million euros) – according to the authority its highest fine to date. Between July 2018 and April 2020, Xandr processed data on Norwegian users of the dating app Grindr and passed it on through real-time bidding for ad space to potentially thousands of advertising companies. Because merely using Grindr can reveal a person's sexual orientation, the data is specially protected and may only be processed with explicit consent.

Xandr failed to check whether Grindr had obtained valid consent and was jointly responsible with the app, the authority found. "The violations in this case are very serious," Datatilsynet head Line Coll said, according to AFP. Responsibility for data protection cannot be handed off to others. Xandr said it had believed Grindr had obtained its users' consent. As the violations predate Microsoft's 2022 acquisition, the fine was calculated on Xandr's own turnover. The company has three weeks to appeal.

The case stems from complaints by the Norwegian Consumer Council (Forbrukerrådet) and privacy group noyb, based on a technical investigation in 2020. Grindr itself had already been fined 65 million kroner, a penalty last upheld by the appeals court in 2025. The decision sends a strong signal to all companies whose business models are built on tracking and profiling consumers online, said Finn Lützow-Holm Myrstad, the Consumer Council's director of digital policy.