Norway fined a Microsoft subsidiary $9.6 million for allegedly misusing Grindr user data
Norway’s data protection authority has fined Xandr, a Microsoft-owned advertising technology company, 92 million Norwegian kroner, about $9.6 million, over the alleged misuse of Grindr users’ sensitive data. The authority says Xandr relied on the app to obtain users’ consent for advertising, rather than ensuring it had explicit consent itself; the penalty is the largest it has issued.
The alleged infringements occurred between July 2018 and April 2020, when users’ data could be passed through Xandr to advertising companies bidding to show targeted adverts. Norway’s consumer council complained in 2020, before Microsoft owned Xandr, and the authority says the fine reflects the seriousness of the case and Xandr’s total annual turnover. Xandr has three weeks to appeal; Grindr previously faced a separate Norwegian fine over similar data-sharing concerns.
- Norway fined Microsoft subsidiary Xandr about $9.6 million.
- The case concerns Grindr users’ sensitive data and advertising consent.
- Xandr has three weeks to appeal the record penalty.
New here? Start with this
Xandr is an advertising technology company owned by Microsoft that helps other companies show targeted adverts to specific audiences. Grindr is a dating app that collects detailed personal information about its users, including data about their sexual orientation and health status. Between 2018 and 2020, Xandr accessed Grindr users' information to help advertisers reach particular audiences.
The issue relates to consent and data protection rules. European regulations require companies that collect personal information for advertising to obtain explicit consent directly from users, rather than relying on another company's consent. Norway's authorities allege that Xandr used Grindr users' data without meeting this requirement, instead depending on the consent Grindr had already obtained from its users.
The case is significant because Grindr holds particularly sensitive personal data, and how advertising companies access such information affects millions of users. Data protection is increasingly a priority for regulators worldwide, who are scrutinising how personal information is shared between apps and advertising technology companies. Recent cases involving dating apps and advertisers reflect growing concerns about whether users properly understand who can access their information.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Users of Grindr deserve explicit knowledge of which entities access their intimate personal data. Xandr improperly assumed that users' consent to Grindr extended to unknown advertising networks, when data protection law requires direct consent from individuals themselves. The fine appropriately reflects the seriousness of processing sensitive data without proper authorisation.
The case against
Xandr operated within standard ad-tech practices where data sharing through platform partners is an expected arrangement in services funded by advertising. The distinction between Grindr's authorisation and explicit Xandr consent may exceed what data protection law practically demands, and a substantial retrospective fine imposed years later could be disproportionate to actual user harm. Such large penalties risk burdening legitimate business operations without clear evidence users were genuinely deceived.