Norway hits Microsoft-owned Xandr with a record NOK 92 million fine over Grindr data
Norway fined Microsoft-owned ad-tech firm Xandr a record NOK 92 million over Grindr user data — sexual orientation included — shared via real-time bidding.
Norway’s data protection authority, Datatilsynet, hit Xandr — the ad-tech company Microsoft bought in 2022, formerly known as AppNexus — with a NOK 92 million fine (about €8.5 million) announced on October 12. It is the largest violation fee the authority has ever issued. The finding: from July 2018 to April 2020, Xandr passed along data from Grindr users, including information that reveals sexual orientation, to potentially thousands of companies through real-time bidding auctions, without a valid legal basis. Thousands of Norwegian users were affected. Datatilsynet also ruled that Xandr and Grindr were joint controllers, which means the ad-tech middleman carries the same legal duty as the app itself.
Key points
- The NOK 92 million fine was calculated on Xandr’s own turnover, not Microsoft’s — the violations happened while Xandr was still independent.
- The unlawful sharing ran for nearly two years (July 2018 – April 2020) and reached “potentially thousands of companies” via real-time bidding.
- Regulators classified Xandr and Grindr as joint controllers: responsibility for valid consent “cannot be passed on to others” anywhere in the ad-data chain.
Background
The case started with a 2020 investigation. In January that year, the Norwegian Consumer Council published “Out of Control,” showing how ordinary apps leak personal data to a sprawling chain of third parties. The council and the privacy group noyb then filed complaints against Grindr and a roster of ad-tech firms, including the company then called AppNexus. Grindr itself was fined NOK 65 million in 2021, a penalty that survived its appeal. What makes this decision different is where it lands: the previous fine hit the app, this one hits the intermediary. Xandr sat on both sides of the real-time bidding table — buying and selling — treating Grindr users’ sensitive attributes as just another input to the auction.
The facts
| Item | Detail |
|---|---|
| Fine | NOK 92 million (~€8.5 million), Datatilsynet’s largest ever |
| Fined party | Xandr (formerly AppNexus, now part of Microsoft) |
| Violation period | July 2018 – April 2020 |
| Data involved | Grindr users’ personal data, including sexual orientation clues (a GDPR special category) |
| Channel | Real-time bidding; Xandr participated on both the buy and sell side |
| Recipients | Potentially thousands of companies |
| Affected users | Thousands in Norway |
| Responsibility | Xandr and Grindr ruled joint controllers |
| Fine basis | Xandr’s own annual turnover, not Microsoft’s |
| Appeal window | 3 weeks from receiving the decision |
Three findings deserve attention on their own. First, joint controllership: Datatilsynet rejected the idea that Xandr was a neutral pipe — it had a say in the purposes and means of processing, so it shares responsibility with Grindr rather than hiding behind it. Second, Xandr argued it assumed Grindr had collected valid user consent; the authority dismissed the defense, saying every participant in the real-time bidding chain must verify consent for itself, because responsibility for data protection cannot be outsourced upstream. Third, the size: aggravating factors included the near-two-year duration, a business model whose core is processing personal data, and direct financial gain. The turnover basis matters too — the authority explicitly declined to calculate the fine on Microsoft’s revenue, since Xandr was not yet part of Microsoft when the violations occurred.
What others say
Microsoft’s response, reported by NRK and VG: a spokesperson said user privacy is the company’s top priority, stressed that the decision concerns conduct from before Microsoft acquired Xandr, noted that legal standards and practice have kept evolving since, and said the company is reviewing the decision and evaluating its options.
The complainants called it a privacy win. Felix Mikolasch, a data protection lawyer at noyb, said ad-tech companies “often operate in the background and are rarely held accountable.” Finn Myrstad, director of digital policy at the Norwegian Consumer Council, called the penalty a powerful signal to every business built on tracking and profiling consumers. The council’s director Mette Fossum went further in comments to VG: once every actor that touches personal data in the ad system is responsible for valid consent, “it is hard to see how today’s system of surveillance-based marketing can be legal.”
The sharper conflict is legislative. In the same statement, noyb warned that the EU Commission’s proposed Digital Omnibus — pushed hard by big-tech lobbying, in the group’s words — could exempt online tracking IDs from the GDPR entirely. If it passes as drafted, the kind of tracking Xandr was fined for would face a much lower bar going forward. A record fine and a loosening bill are moving through Europe at the same time.
Our take
For anyone building ad tech, growth tooling, or any product that monetizes user data, the decision settles three things. Compliance responsibility cannot be outsourced: whether you buy or sell the traffic, touching the data means verifying the consent chain yourself — an upstream SDK’s privacy policy or a partner’s assurances are not a defense. Fines follow the entity that did the violating: acquiring a company does not erase its data-compliance history, so diligence on any ad asset should dig through it the way you would patents and lawsuits. And with the largest fine the Norwegian DPA has ever issued landing on a middleman, every seat in the real-time bidding chain now has an audit problem.
The honest counterweight: the conduct ended more than six years ago, Microsoft inherited it rather than committed it, and the Digital Omnibus may soon make this category of tracking easier, not harder, in the EU. Enforcement tightening and legislative loosening at once is the ad-tech industry’s situation in miniature. Advertising is becoming central to how AI companies make money — OpenAI already put ads inside image-generation results — and compliance costs like this one belong in their models. Regulators have spent this year descending on AI labs from several directions; Europe’s finest shows the ad-data chain is another enforcement line with teeth.
What to watch
Xandr has three weeks from receiving the decision to appeal, and Microsoft says it is weighing its options. Two things to track: whether an appeal comes — Grindr’s appeal only confirmed its fine, and the process produced a more fully reasoned ruling — and the Digital Omnibus’s progress in the European Parliament, which decides whether the next Xandr has a fine to worry about at all.