Norway’s data protection authority has imposed a 92 million Norwegian kroner fine on Xandr, the advertising-technology company owned by Microsoft, over its alleged use of sensitive Grindr user data for advertising purposes. The penalty, valued at roughly $9.6 million, is the largest the authority has issued to date.
The case focuses on a foundational but often opaque question in digital advertising: who is responsible for making sure a person has clearly agreed before sensitive information is used across an advertising system? Norwegian regulators allege that Xandr did not obtain the required explicit consent itself. Instead, the authority says, it assumed Grindr had already secured that permission from users.
Xandr has three weeks to appeal the decision. As described, the alleged infringements occurred from July 2018 through April 2020, before Microsoft owned Xandr. That timeline matters for understanding the conduct under scrutiny, but it does not change the present ownership status cited in the decision.
What Norwegian regulators say happened
The Norwegian Data Protection Authority says that, when people opened Grindr, personal data was in many cases passed through Xandr into an advertising ecosystem with potentially thousands of participants. Those participants could bid to show a targeted advertisement, while the underlying process remained out of view for the person using the app.
“When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem,” the authority said.
That description illustrates why the case is much broader than a conventional complaint about an unwanted ad. The allegation concerns the transmission and use of personal data in the machinery behind advertising decisions. A person may see a single ad, but the delivery of that ad can involve a chain of companies and automated systems. The regulator’s concern is that sensitive information was involved in that chain without explicit consent established for Xandr’s use.
Explicit consent, in the terms relevant here, means a person must actively and clearly agree to a particular use of sensitive data. The allegation is not merely that a consent flow was hard to read or that someone may have been unaware of a privacy setting. It is that Xandr relied on an assumption that another company had secured the necessary approval, rather than obtaining the legally required consent for the data use at issue.
For apps and advertising firms, that distinction is consequential. A data recipient may view an app’s consent collection as the start of its compliance process. Norway’s action signals that a company cannot necessarily treat that upstream collection as a blank check—particularly where sensitive user data and a large advertising network are involved.
Why Grindr data raises especially serious privacy questions
Grindr is a dating app, and information connected to its users can carry unusual sensitivity even where a specific data field is not spelled out in the available account. The Norwegian authority characterized the alleged misuse as very serious, a view reflected in the size of the penalty.
The concern becomes sharper because the regulator says the information could be relayed to a potentially vast number of advertising actors. Targeted advertising is commonly understood as matching ads to information about an individual or a category of users. But the practical privacy issue in this case is not only the final match. It is also disclosure: each additional participant in a data flow can create another point at which highly personal information is handled.
Advertising systems are often designed to operate in fractions of a second. Advertisers bid against one another to reach a user, and the winner receives the chance to display an ad. That speed and automation may help explain why the experience can be invisible to users, but it does not remove the consent question. Norway’s regulator specifically emphasized that the bidding activity was hidden from the individual.
In plain terms, an app user might understand that advertising supports a service. They may not understand that a data signal associated with opening the app could be sent through an extensive system in which multiple entities assess an opportunity to target them. The enforcement action places the spotlight on that gap between the visible app experience and the less visible advertising infrastructure behind it.
A complaint dating back to 2020
The proceeding began with a complaint filed in 2020 by Norway’s consumer council. At the time, Xandr was not owned by Microsoft. The complaint accused the adtech company of unlawfully sharing personal data for commercial purposes without securing consent first.
The authority said it calculated the fine using Xandr’s total annual turnover. That is significant because the final figure is not presented simply as a fixed charge for one technical misstep. It reflects the regulator’s assessment of the seriousness of the alleged conduct and an enforcement approach tied to the company’s overall scale.
The 92 million kroner sanction is therefore notable on two levels: it is a record for the Norwegian authority, and it addresses how responsibility is distributed between an app that gathers user information and an advertising-technology company that processes or relays it for ad targeting.
The case should not be read as an allegation that every company receiving app data automatically bears the same responsibility in every arrangement. Its significance is narrower and more practical: a business using sensitive information for advertising cannot safely assume that consent collected elsewhere satisfies its own obligations. The facts, the type of data, and the precise permissions obtained all matter.
Grindr has faced separate privacy scrutiny
Xandr is the accused party in this action, but Grindr has also faced its own prior case before the same Norwegian authority. The app was previously fined more than 5.6 million euros, roughly $6.2 million, over similar concerns involving improper sharing of sensitive user data.
Separately, Grindr was sued in London in 2024 over allegations that data shared included users’ HIV status and test dates. Those allegations are distinct from the Norwegian penalty against Xandr, but together they underline why the handling of information tied to a dating platform has remained subject to close scrutiny.
It is important not to collapse these matters into one claim. The present fine concerns allegations about Xandr’s consent practices and advertising use of Grindr-related data. The earlier regulatory action against Grindr and the London lawsuit involve their own allegations, parties, and legal questions. Their shared relevance is the sensitivity of the underlying information and the risks that emerge when it moves beyond the service where a user originally provided it.
What the decision could mean for adtech accountability
This action is a reminder that the advertising supply chain is not just a technical backdrop. It is a set of decisions about collecting, passing along, using, and safeguarding user information. In the regulator’s account, Xandr’s alleged mistake was not simply sending an ad request; it was proceeding without explicit consent while personal data was being relayed through a large ecosystem.
For users, the practical takeaway is that privacy choices inside an app may affect far more than the app itself. The user interface may show a short consent prompt, while the resulting advertising process can involve many entities operating beyond the screen. This is why clear information and meaningful consent matter: people need a genuine opportunity to understand what is being authorized.
For companies, the decision highlights the limits of contractual or operational assumptions. If one firm collects a person’s data and another firm uses it to support advertising, both sides need clarity on what the person agreed to and whether that agreement covers the sensitive-data use in question. A system can be technically efficient and still fall short if its permission structure is not sufficiently explicit.
The penalty also arrives amid sustained attention on how large technology businesses develop and deploy data-driven systems. For another current look at the sector’s AI ambitions and product direction, see this report on Meta’s Muse Wonder models.
Xandr now has three weeks to appeal. Until then, the Norwegian authority’s record fine stands as a sharp warning about the stakes of sensitive data in targeted advertising: the fact that a data flow is automated, fast, or buried in an adtech chain does not make consent optional.
