Norway's data protection authority, Datatilsynet, has fined Xandr, now part of Microsoft, NOK 92 million (about €8.6 million, or $9.6 million) for its role in real-time ad auctions inside the Grindr dating app. Datatilsynet's announcement says it is the largest fine the authority has issued. The EDPB's summary dates the decision to 2 October 2026.
What the regulator found
The infringements ran from July 2018 to April 2020. Xandr took part in real-time bidding, in which advertisers bid for placements after receiving profiling information about the user. According to Datatilsynet, that exposed data revealing sexual orientation to thousands of companies. The data included the fact that someone uses Grindr, advertising IDs and IP addresses.
Three findings carry the decision:
- Sexual orientation is special-category data. The EDPB summary says the data fell under GDPR Article 9(1), so explicit consent under Article 9(2)(a) was the relevant basis.
- Xandr was a joint controller with Grindr. It acted on both the supply and demand side of the auctions, so it could not treat Grindr as the only party responsible.
- Relying on someone else's consent was not enough. Xandr assumed Grindr had collected valid consent and did not check. The authority rejected that. BleepingComputer quotes Director General Line Coll saying Xandr "omitted to verify that the consents from Grindr were valid."
The case began with a 2020 complaint from the Norwegian Consumer Council. Noyb, the Austrian privacy group, supported the complaint, and the findings follow a path Norwegian courts have already cleared. On 21 October 2025 the Borgarting Court of Appeal upheld the NOK 65 million fine against Grindr. The court found Grindr lacked valid consent to disclose data to advertising partners, and that data about a person's use of the app is special-category data. The Xandr decision applies the same reasoning to the other end of the pipe.
The strongest case for the fine
The argument for severity is strong. Sexual orientation is among the most dangerous categories of data to leak. In many jurisdictions, exposure can mean harassment, blackmail or worse. Users of a dating app had no practical way to trace where their data went after an auction. A bidding system that broadcasts a profile to thousands of recipients also makes meaningful consent hard to give and impossible to withdraw. The authority said the long duration and Xandr's direct financial benefit weighed heavily. A fine of this size also tells the market that sensitive-data violations are not a rounding error.
The quantum is also moderate. Datatilsynet calculated it on Xandr's own turnover rather than Microsoft's, because Xandr was not part of Microsoft during the period. Nobody can fairly call it confiscatory.
Where proportionality matters
The enforcement logic is sound, but its limits deserve attention. The principle that matters most is the one Datatilsynet stated: responsibility for data protection "cannot be passed on to others." Applied to a downstream intermediary, it creates a duty to verify, and a duty to verify needs a defined standard. The decision, as summarized by the EDPB, says each joint controller must confirm that consent is valid and covers its own processing. It does not say what level of diligence is enough. A contractual warranty? A sampled audit? A technical consent signal that can be checked?
That gap matters for innovation. Large firms can run audits and absorb the legal cost. A small ad-tech or analytics start-up has far less room for error, and unclear duties tend to push smaller players out of the market while the largest consolidate. Regulators should pair enforcement with guidance on what verification looks like in practice, ideally through the European Data Protection Board, so that the rule is predictable across the EU and EEA.
The facts here also make this an easy case. This was not a dispute over a borderline cookie banner. It involved the most protected category of data, a consent flow that Norwegian courts had already found invalid for Grindr, and broad dissemination to a large number of companies. Reading the decision as a mandate for aggressive action against all programmatic advertising would overreach. The better reading is narrow: when you know you are handling data that can reveal sexual orientation, health or similar traits, you must establish for yourself that the legal basis is real.
What happens next
Xandr has three weeks from receiving the decision to appeal, according to Datatilsynet. Microsoft told BleepingComputer the investigation focused on conduct that predates its acquisition of Xandr, and that it is reviewing the decision and assessing its options. Grindr's own case took from December 2021 to October 2025 to resolve through the Privacy Appeals Board and the courts. Any Xandr appeal could raise the same questions, including how far a joint-controller finding extends and what verification demands.
For the open internet, the sensible outcome is a clear verification standard rather than a chilling one. Advertising pays for much of the free web. It does not need to be built on opaque auctions that leak the most intimate facts about people. Companies that handle sensitive categories should treat supplier consent as something to test, not to assume. Regulators, in turn, should say what testing is enough, so that compliance is something a well-run firm of any size can achieve.