Norway fines Microsoft subsidiary Xandr $9.6 million over use of Grindr user data

The Norwegian Data Protection Authority (NDPA) has imposed a fine of 92 million Norwegian kroner, around $9.6 million, on Xandr, an advertising technology company that is a subsidiary of US software group Microsoft. The regulator says Xandr did not obtain explicit consent before using sensitive data of users of the dating app Grindr for advertising. It is the largest fine the NDPA has issued to date, and Xandr has three weeks to appeal.

What the regulator alleges

According to the NDPA, Xandr simply assumed that Grindr had already secured users' approval, rather than obtaining consent itself. The authority said that when a person opened Grindr, their personal data was in many cases passed through Xandr to potentially thousands of players in the advertising ecosystem. Advertisers could then bid against one another to show targeted ads, all of it hidden from the user.

The infringements took place between July 2018 and April 2020, the regulator says. The fine was calculated on the basis of Xandr's total annual turnover, and the authority described the misuse of data as very serious, which it cited as justification for the high amount.

How the case began

The case dates to 2020, when Norway's consumer council filed a complaint with the NDPA against Xandr. It accused the company of unlawfully sharing users' personal data for commercial purposes without prior consent. Xandr was not owned by Microsoft at that time.

Grindr's own record

Grindr has also been involved in cases over improper sharing of sensitive user data. The same Norwegian agency earlier fined the app more than 5.6 million euros, around $6.2 million, for similar reasons. In 2024, Grindr was also hit with a lawsuit in London over allegedly sharing data that included users' HIV status and test dates.