Norway fines Microsoft's Xandr $9.6 million for Grindr data breach

Norway's Data Protection Authority, Datatilsynet, has fined Microsoft-owned advertising company Xandr $9.6 million. The landmark penalty, the largest ever issued by the authority, is for the unlawful processing and sharing of sensitive data from users of the Grindr dating app.

How the data breach occurred

Xandr facilitated real-time advertising auctions inside the Grindr app between July 2018 and April 2020. The company acted as an intermediary, exposing profiling information about users to thousands of bidding companies. Datatilsynet found Xandr was a joint data controller with Grindr at the time.

Sensitive information, including data that could reveal a user's sexual orientation, was shared without valid user consent. The authority stated Xandr assumed Grindr had obtained proper consent but took no steps to verify this legal basis for its own processing. The decision applies specifically to auctions run in the nearly two-year period.

Origins of the complaint and industry reaction

The case began with a joint complaint filed in January 2020 by the Austrian privacy nonprofit noyb and the Norwegian Consumer Council, Forbrukerrådet. Both groups welcomed the fine as a significant enforcement action.

Noyb called the decision a major blow to the online adtech industry and a brake on the bad practices of large players. The group stated it addresses the covert exchange of sensitive user data across platforms. "Profiling people’s interests, habits, location, and behavior requires valid consent, which adtech companies hardly ever obtain," noyb said.

Microsoft's position and next steps

Microsoft has responded to the fine, noting the investigated conduct predates its acquisition of Xandr. A company spokesperson said legal frameworks and their enforcement have evolved since the period in question. Microsoft is reviewing the decision and assessing its options.

Xandr was given three weeks to appeal. Microsoft has not confirmed whether it will file an appeal before the deadline expires. For Grindr users, the ruling concerns past data processing and does not mandate a new app setting.

Broader implications for data privacy

The ruling establishes that companies acting as joint controllers cannot assume another party has secured valid consent. They must actively verify the legal basis for processing sensitive personal data. Datatilsynet Director General Line Coll emphasized the seriousness of the breaches.

"We issued such a high fine in this case because the breaches we identified were very serious," Coll said. She noted that thousands of users in Norway were subjected to unlawful sharing of their sensitive data. The decision shows growing regulatory scrutiny of adtech data flows, particularly involving information from vulnerable groups. Microsoft is reviewing the decision and assessing its options before the three-week appeal deadline expires.