Xandr receives record €8.6M fine

Norway draws a hard line around ad-tech consent

Norway’s Data Protection Authority has fined Xandr NOK 92 million, which the regulator equates to €8.6 million, after finding that the Microsoft-owned advertising technology company processed and shared sensitive Grindr user data unlawfully [1]. The authority says the penalty is the highest fine it has ever issued, making the case more than a routine enforcement action against a data broker or ad exchange [1].

The core finding is simple and severe: Xandr acted as an intermediary in real-time bidding and relayed personal data about Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of companies in the advertising ecosystem [1]. In the regulator’s view, that data could not be treated as ordinary ad inventory metadata, because the fact that a person uses Grindr itself indicates sexual orientation and therefore falls under the GDPR’s special-category protections [1].

The decision matters because the target is not the consumer-facing app alone. Xandr did not run Grindr, but it helped operate the advertising machinery around it. Norway’s regulator concluded that an ad-tech intermediary cannot simply assume that the app obtained valid consent, nor can it push responsibility back up or down the chain when sensitive data flows through programmatic advertising systems [1].

What Xandr was found to have done

According to the regulator, the case began in 2020 when the Norwegian Consumer Council lodged a complaint against Xandr, then connected to the matter under its earlier AppNexus identity and now part of Microsoft [1]. The complaint grew out of broader scrutiny of how mobile apps transmitted personal data to advertising partners for surveillance-based advertising [2].

The authority found that Xandr participated in real-time bidding on both the buyer and seller side [1]. When a user opened Grindr, personal data was in many cases routed through Xandr to a large number of actors that could bid to show a targeted advertisement, while the user remained largely unaware of the behind-the-scenes data circulation [1].

That system is fast, automated and opaque. Real-time bidding allows websites and apps with ad space to send data about users to advertising platforms, enabling advertisers to compete for the opportunity to show personalized ads in fractions of a second [1]. In this case, the regulator’s concern was not merely that advertising happened, but that data tied to a highly sensitive context was circulated without a valid legal basis [1].

Xandr’s defense, as summarized by the regulator, was that it believed Grindr had collected user consent [1]. The Norwegian authority rejected that framing, saying that each company must itself ensure and document lawful processing and that responsibility for data protection cannot be passed to another actor [1].

Why Grindr data is legally sensitive

The case turns on a crucial privacy point: using Grindr was treated as data that may reveal sexual orientation [1]. Under the GDPR, data concerning sexual orientation is special-category data, which receives stronger protection and generally requires a specific exemption, such as explicit consent, before processing [1].

Norway’s authority concluded that explicit consent was required and that Xandr had not done enough to ensure such consent existed [1]. It also found Xandr to be a joint controller with Grindr for the relevant processing, meaning Xandr had its own responsibilities rather than a merely passive technical role [1].

That conclusion is especially important for the ad-tech market. Intermediaries often sit several steps away from the user interface, contracts and consent screens. The Norwegian decision signals that distance from the user does not remove accountability when a company receives, enriches, routes or monetizes personal data in a way that helps determine advertising outcomes [1].

The Norwegian Consumer Council framed the fine as a landmark result from its 2020 action with noyb, saying Xandr is now part of Microsoft Advertising and that the case sends a signal to companies whose business models depend on tracking and profiling consumers online [2]. Noyb likewise described the decision as a major blow to the online advertising and commercial surveillance industry, arguing that ad-tech companies often operate in the background while accumulating and sharing large volumes of personal data [3].

Microsoft inherits the governance problem

The penalty lands on a Microsoft-owned asset, but the regulator did not calculate the fine based on Microsoft’s overall turnover [1]. Datatilsynet says the infringements occurred from July 2018 to April 2020, while Xandr was not part of Microsoft during that period, so the amount was calculated based on Xandr’s own total annual turnover [1].

That distinction limits the immediate financial exposure, but it does not eliminate the corporate governance issue. Microsoft acquired Xandr later, and the case now attaches a prominent privacy enforcement history to an advertising business within the Microsoft ecosystem [1]. Reuters reported that Microsoft said the conduct predated its acquisition and that it was reviewing the decision and assessing its options [5].

For large technology companies, the lesson is broader than this single inherited asset. Privacy risk can survive acquisitions, especially where the target’s business depends on data flows, consent records, bidstream logs and relationships with thousands of advertising partners. Due diligence in ad-tech acquisitions cannot stop at revenue, inventory and customer contracts; it must also ask whether historical consent, controller roles and data-retention evidence will withstand regulatory review years later.

The case also raises a practical compliance question: what records exist when regulators ask how consent was obtained and verified? Reporting on the decision noted that the underlying case file addressed Xandr’s inability to produce certain documentation after data had been deleted under retention policies, even though the investigation had already begun [6]. That point reinforces a basic rule for heavily regulated data businesses: deletion policies do not excuse a failure to preserve evidence needed to demonstrate GDPR compliance.

Why the fine is a precedent for behavioral advertising

The Xandr sanction follows earlier enforcement around Grindr’s own sharing of user data. The Norwegian regulator notes that Grindr had already received a NOK 65 million fine for equivalent breaches, and that the Borgarting Court of Appeal also treated Grindr use as information indicating sexual orientation [1]. The new decision extends the accountability lens from the app to an intermediary in the advertising supply chain.

That is the precedent ad-tech companies should study. If an app, publisher or platform passes special-category data into a bidding environment, downstream and intermediary actors may not be able to rely on contractual assumptions alone. The regulator’s message is that each participant must be able to prove a valid legal basis for its own processing [1].

The financial size of the penalty is also notable. NOK 92 million is not a record by EU-wide GDPR standards, but it is Norway’s largest privacy fine to date and therefore a strong national signal [1]. More importantly, it was imposed on an advertising technology company for its role in a chain of disclosure, not only on the brand-facing service where the user opened an account [1].

BleepingComputer reported that the real-time auctions potentially exposed sensitive information about Grindr users to thousands of companies, and that Xandr acted as the intermediary in those auctions [4]. The Hacker News similarly reported that the infringements occurred between July 2018 and April 2020 and that Xandr has three weeks to appeal the decision [6].

The compliance takeaway

The most immediate takeaway is that “we thought the app had consent” is not a safe compliance strategy. Where special-category data is involved, companies in the advertising pipeline need evidence that consent is explicit, valid, documented and specific to their own processing [1].

The second takeaway is that programmatic advertising architecture itself is under scrutiny. Norway’s regulator emphasized the opacity of the advertising ecosystem and the practical risk that user rights become meaningless when companies blame one another [1]. Consumer and privacy groups are using the decision to argue that surveillance-based advertising remains structurally difficult to reconcile with meaningful consent [2][3].

For Microsoft, the fine is financially manageable but reputationally awkward. For Xandr and similar ad-tech platforms, it is a warning that regulators are willing to follow sensitive data beyond the app screen and into the pipes that make behavioral advertising work. The record €8.6 million fine is therefore not just about Grindr, nor only about Norway; it is a test case for whether hidden advertising infrastructure can be held to the same standard as the services users actually see.

Sources from the last 72 hours

1. [1]Microsoft company fined NOK 92 millionOct 12, 2026, 2:00 AM
2. [2]Microsoft company fined 8,5 million euros following complaint by the Norwegian Consumer Council and noybOct 12, 2026, 2:00 AM
3. [3]Privacy win: Norwegian Authority fines Microsoft’s Xandr € 8.5 MillionOct 12, 2026, 2:00 AM
4. [4]Norway fines Microsoft ad firm $9.6 million over Grindr data sharingOct 12, 2026, 10:13 PM
5. [5]Norway fines Microsoft's Xandr $9.6 million over Grindr data sharingOct 12, 2026, 2:00 AM
6. [6]Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual OrientationOct 13, 2026, 2:00 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.