Norway Fines Microsoft Ad Firm $9.6 Million Over Grindr Data
Norway's Data Protection Authority has issued its largest-ever fine against a Microsoft-owned advertising company for unlawfully processing and sharing sensitive user data.
Radwan AbdulhadiEditor and technology writer
Record Fine Issued by Norwegian Regulators
Norway’s Data Protection Authority has issued a massive penalty against a major advertising firm, marking a historical milestone for the agency. According to reports covered by <a href="https://www.bleepingcomputer.com/news/security/norway-fines-microsoft-ad-firm-96-million-over-grindr-data-sharing/">BleepingComputer</a>, Datatilsynet fined Microsoft-owned advertising company Xandr NOK 92 million, which amounts to approximately $9.6 million.
The data protection authority stated that this financial penalty is the largest fine it has ever issued in its history. Line Coll, Director General of Datatilsynet, emphasized the gravity of the infractions uncovered during the regulatory review.
“We issued such a high fine in this case because the breaches we identified were very serious,” Line <a href="http://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/">Coll stated</a>. “Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.”
Unlawful Data Sharing Through Real-Time Ad Auctions
The enforcement action stems from activities that took place between July 2018 and April 2020. During this timeframe, Xandr managed real-time advertising auctions inside Grindr, a prominent location-based dating app primarily serving the LGBTQ+ community.
These ad auctions allowed advertisers to bid for the right to display advertisements to Grindr users after receiving profiling information from Xandr, which operated as an intermediary. Through this mechanism, sensitive information—including data regarding sexual orientation—was potentially exposed to thousands of corporate entities.
Investigators established that Xandr functioned as a joint controller alongside Grindr during the period in question. This designation meant Xandr held direct responsibility for how user data was handled and was legally obligated to demand and obtain explicit user consent.
Lack of Verification and Consent Mechanisms
According to the findings released by Norway's data privacy agency, Xandr merely assumed that Grindr had successfully gathered valid consent from users. However, the advertising firm failed to take any active steps to verify those assumptions.
“Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing,” Line Coll pointed out.
Consequently, highly sensitive details regarding Grindr users residing in Norway and other international locations were broadcasted to thousands of commercial advertisers. This data exposure occurred entirely without the knowledge or explicit consent of the affected individuals.
Privacy Advocates Applaud Regulatory Enforcement
The original complaint against the platform practices was filed back in January 2020 by the Austrian nonprofit privacy rights organization Noyb, operating in collaboration with the Norwegian Consumer Council, known locally as <a href="https://www.forbrukerrådet.no/side/complaints-against-grindr-and-five-third-party-companies/">Forbrukerrådet</a>.
Both organizations publicly praised Datatilsynet’s decision, categorizing the ruling as a significant blow against harmful practices prevalent within the broader online advertising and commercial surveillance industry.
Prominent privacy advocates pointed out that the decision targets the covert and unrestricted exchange of sensitive user data across websites, applications, platforms, and underlying operating systems.
“The current fine shows that companies such as Xandr are eventually held accountable for their shady practices,” <a href="https://noyb.eu/en/privacy-win-norwegian-authority-fines-microsofts-xandr-eu-85-million">Noyb said</a>. “Profiling people’s interests, habits, location, and behavior requires valid consent – which adtech companies hardly ever obtain.”
Microsoft Response and Next Steps
Following the enforcement announcement, Xandr—which currently operates under the brand Microsoft Advertising—was granted a strict three-week window to officially appeal the regulatory decision.
When reporters reached out for statements, a corporate spokesperson for Microsoft highlighted that the core investigation and its ultimate findings focus strictly on conduct that occurred well before Microsoft finalized its acquisition of Xandr.
The Microsoft representative further noted that legal frameworks, along with how they are interpreted and enforced, have evolved since that period. The company confirmed it is actively reviewing the regulatory decision and evaluating available options moving forward.
Sources
- BleepingComputerNorway fines Microsoft ad firm $9.6 million over Grindr data sharing
Continue chronologically
Related entity coverage
Related stories
Norway Fines Microsoft Subsidiary Over Grindr User Data
Norway's data protection agency has issued a record $9.6 million fine to Microsoft subsidiary Xandr for allegedly misusing Grindr user data.
Microsoft Camouflages Data Centers With Nature and Wetlands
Microsoft is implementing a biomimicry program to blend more than 20 data center sites into natural landscapes using wetlands and native gardens.
Microsoft Authenticator Replaces Backup With Google One
Microsoft Authenticator for Android is replacing its own password and account backup system with Google One starting in January.
Microsoft Launches Campaign to Trade In Unused Xbox Consoles
Microsoft is emailing Xbox owners with opportunities to trade in unused Series X and S consoles for store credit amid ongoing hardware shortages.
