Norway Imposes $9.6 Million Fine on Microsoft‑Owned Ad Firm Over Grindr Data Misuse

The Legal Breach: Sensitive Data Without Consent

A Norwegian data regulator has levied a record penalty against Xandr, a Microsoft‑owned advertising company, for unlawfully handling sensitive personal data of Grindr users in Norway. The fine, amounting to 92 million Norwegian kroner (about $9.6 million), follows an investigation that uncovered the company’s processing and sharing of users’ sexual orientation and location data without proper consent.

The investigation began after Norwegian privacy watchdog Datatilsynet received complaints that Grindr, a popular dating app for men who have sex with men, had supplied user data to Xandr for targeted advertising. Xandr allegedly used this data to create highly specific audience segments, enabling advertisers to reach users based on their sexual preferences and real‑time whereabouts. The regulator found that the data had been processed in ways that violated Norway’s Personal Data Act and the EU General Data Protection Regulation (GDPR).

Financial and Operational Impact on Xandr

Under GDPR, sexual orientation and location data are classified as „special categories” that require explicit user consent and a lawful basis for processing. Xandr’s handling of Grindr data fell short on both counts. The company failed to obtain clear consent from users before collecting or sharing their sensitive information, and it did not demonstrate a legitimate interest that outweighed the users’ privacy rights. Datatilsynet’s report highlighted that Xandr’s data‑sharing practices enabled advertisers to target users with precision, raising concerns about potential discrimination and profiling.

„We found that the company’s data practices were not only technically flawed but also ethically problematic,” said a spokesperson for Datatilsynet. „The lack of consent and the use of sensitive data for advertising purposes constitute a clear breach of privacy law.”

What Does This Mean for Grindr Users?

The fine places Xandr among the largest penalties imposed on a Microsoft subsidiary for privacy violations. The company has acknowledged the findings and stated that it will review its data‑processing protocols. Xandr’s parent company, Microsoft, has pledged to cooperate fully with Norwegian authorities and to implement stricter safeguards across its advertising ecosystem.

Industry observers note that the penalty could trigger a broader reassessment of how tech firms handle user data in the Nordic region. „This case sends a strong message that privacy regulators will not tolerate the commodification of sensitive personal information,” commented a privacy analyst. „Companies must now prioritize transparent consent mechanisms and robust data governance.”

# Why was Xandr fined instead of Microsoft directly?

Grindr users in Norway may experience increased scrutiny of the app’s data practices. The company has already announced plans to enhance its privacy settings and to provide clearer explanations of how user data is shared with third parties. Users are encouraged to review the app’s privacy policy and adjust their settings to limit data sharing.

# Can Xandr appeal the fine?

The Norwegian regulator’s decision also underscores the importance of user control over personal data. „Users should be able to decide whether and how their sensitive information is used,” said the Datatilsynet spokesperson. „The fine is a step toward ensuring that their rights are respected.”

Xandr operates as a separate legal entity under Microsoft’s ownership. The fine targets the specific entity responsible for the data breach, though Microsoft’s broader compliance framework will also be scrutinized.

# Will this affect advertising on other platforms?

Yes, Xandr can appeal the decision within the Norwegian legal framework. The appeal process will allow the company to present additional evidence or argue procedural errors.

The ruling may prompt regulators worldwide to examine similar practices. Advertisers may need to adjust their targeting strategies to comply with stricter privacy standards.