Robotics

Norway Fines Microsoft Subsidiary Over Grindr User Data

The Norwegian Data Protection Authority has issued a record penalty of $9.6 million to Xandr, an adtech subsidiary of Microsoft, for allegedly failing to obtain explicit consent for utilizing sensitive user data from Grindr.

Radwan AbdulhadiEditor and technology writer

Published: October 12, 2026 · Updated: October 12, 2026 · 3 min read

Norway Fines Microsoft Subsidiary Over Grindr User Data — Image: Engadget

Record Penalty Issued by Norwegian Authorities

The Norwegian Data Protection Authority (NDPA) has charged Xandr, an adtech subsidiary of Microsoft, with a fine of 92 million Norwegian kroner, which is approximately $9.6 million. According to the data protection agency, Xandr allegedly failed to obtain explicit consent to use sensitive user data from individuals on Grindr for advertising purposes. Instead, the company reportedly only assumed that the dating app had already secured proper user approval. This regulatory action marks the highest fine that the Norwegian authority has issued to date, and Xandr has three weeks to appeal the record penalty.

Details of the Advertising Data Sharing

In a published press release, the NDPA detailed how user information moved through the ecosystem when applications were opened. "When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem," the NDPA wrote. The agency further noted that advertisers were able to bid against each other to present targeted adverts, all while remaining completely hidden from the individual user.

Image related to the report from Engadget · Source: Engadget

Origins of the Investigation and Complaint

The regulatory case began back in 2020 when the country's consumer council filed a formal complaint against Xandr with the NDPA. At the time of the alleged infractions, Xandr was not owned by Microsoft. The initial complaint accused Xandr of unlawfully sharing users' personal data for commercial purposes without securing prior consent. The Norwegian data authority justified the heavy financial penalty by classifying the data misuse as "very serious." Furthermore, the NDPA noted that the fine was calculated based on Xandr's total annual turnover, with the specific data infringements occurring between July 2018 and April 2020.

Broader Regulatory Scrutiny on Grindr

While Xandr stands as the accused offender in this current enforcement action, Grindr itself has previously faced regulatory consequences for improperly sharing sensitive user data. Earlier, the same Norwegian agency charged the dating app with a fine exceeding 5.6 million euros, or roughly $6.2 million, for similar data-sharing reasons. In addition to regulatory fines, the dating platform was also hit with a lawsuit in London in 2024 for allegedly sharing data that included the HIV status and test dates of its users.