Norway's data protection authority, Datatilsynet, has fined Xandr, an ad-tech company now part of Microsoft, NOK 92 million (about €8.6 million, or roughly $9.6 million). It is the largest fine the authority has ever issued. The decision is dated 2 October 2026 and was announced on 12 October. It finds that Xandr ran real-time bidding auctions inside the Grindr app that exposed users' sexual-orientation data to potentially thousands of companies, without a valid legal basis.
What Datatilsynet found
The infringements ran from July 2018 to April 2020. According to Datatilsynet's announcement, Xandr was a joint controller with Grindr. It took part in real-time bidding, in which data about Grindr users in Norway was relayed to potentially thousands of advertising actors. The regulator notes that being a Grindr user is itself information indicating sexual orientation. That puts the data in the special category covered by Article 9 of the General Data Protection Regulation, which in principle requires explicit consent.
Xandr's defence was that it relied on Grindr to collect consent. The regulator rejected that. BleepingComputer reports that Xandr assumed Grindr's consents were valid and "omitted to verify" them. Director General Line Coll said that "responsibility for data protection cannot be passed on to others." The regulator also counted the long duration and Xandr's direct financial benefit when setting the amount.
The fine is based on Xandr's own annual turnover, not Microsoft's. Xandr was not part of Microsoft during the infringement period. Microsoft says the case concerns conduct that predates its acquisition and that it is reviewing its options. Xandr has three weeks to appeal, so the decision is not final.
The strongest case for the decision
The regulator's position deserves a fair hearing. Real-time bidding is an unusual processing chain. A user opens an app, and within milliseconds a bid request carrying an advertising ID, IP address and app identity is broadcast to many parties. The user cannot see who receives it or what happens next. If the only check on that chain is each party's assumption that someone upstream collected consent, then in practice no one is accountable. Sexual orientation is among the most sensitive categories there is, and in many countries disclosure can bring real harm. Under that logic, an intermediary that profits from the auction should carry a duty to check that the consent behind it is valid.
The case also builds on enforcement already completed. Grindr itself was fined NOK 65 million in 2021 for equivalent breaches, and the Borgarting Court of Appeal upheld that fine, according to Datatilsynet. The Xandr decision extends accountability from the app to the intermediary that monetised the data.
Where proportionality still matters
The decision is defensible on its facts, but the lessons for policy are more mixed than the headlines suggest.
- Verification has to be workable. A duty to verify consent is sensible. But the rules must say what verification means in a system where decisions are made in milliseconds. The EDPB's Guidelines 07/2020 set out how to identify controllers and joint controllers, but they do not turn that into a checklist for auction participants. Firms need predictable, auditable standards such as contractual warranties, sampling audits and consent-string validation. Without them, the obligation becomes a liability lottery.
- Targeted enforcement beats blanket suspicion. This case works because the data was extremely sensitive, the harm was concrete, and the consent chain was demonstrably unchecked. Applying the same reasoning to every ad-supported service would punish ordinary advertising that carries no special-category risk, and it would raise costs for smaller publishers and start-ups more than for incumbents.
- Retrospective timing is a concern. The conduct ended in April 2020, and the fine arrives more than six years later. Long enforcement timelines make it hard for firms to learn from a ruling while the facts are still current. They also invite the argument that rules have since changed. Microsoft already makes that argument.
The scale of the fine is also worth keeping in perspective. The GDPR allows fines of up to €20 million or 4% of worldwide annual turnover for the most serious infringements, under Article 83(5). NOK 92 million is well inside that ceiling. It is a record for Norway, but it is modest by EU standards, which suggests the signal is meant to be about the legal principle rather than the money.
What to watch
Two things will decide how far this goes. The first is the appeal. If Xandr contests the finding that it had to verify consent, a court's view of joint-controller duties in real-time bidding would carry weight well beyond Norway. The second is whether other European regulators take the same position on intermediaries. The privacy group noyb, which was involved in the original complaint, calls the decision a major blow to the ad-tech industry.
For companies, the practical answer is not to abandon advertising but to treat sensitive-category traffic differently. That means excluding it from open auctions, documenting how consent is validated, and ensuring that any party in a bidding chain can show its own legal basis. Those are proportionate, evidence-based steps. They protect the people most exposed to harm without taxing the open, ad-funded web that most of the internet runs on.