Microsoft’s Ad Firm Fined $9.6 Million in Norway Over Grindr Users’ Data Sharing

Microsoft’s advertising business has landed in hot water over sensitive user data. Norway has fined Microsoft-owned Xandr approximately $9.6 million for unlawfully processing Grindr users’ information and exposing it to thousands of advertising companies. The regulator says the case marks its largest fine ever.

Norway says Xandr failed to verify user consent

The Norwegian Data Protection Authority imposed a fine of 92 million Norwegian kroner, equivalent to roughly $9.6 million (via Reuters). The case concerns data processing between July 2018 and April 2020, before Microsoft acquired Xandr in 2022.

During that period, Xandr operated in Grindr’s real-time advertising auctions. The system allowed advertisers to bid for ad placements using profiling information about users. That information could reveal sensitive details, including users’ sexual orientation.

According to the regulator, Xandr assumed Grindr had obtained valid consent but failed to verify it. The authority held Xandr responsible for ensuring its own advertising-related data processing had a valid legal basis. Here’s what the regulator said:

The Norwegian Data Protection Authority has now concluded that the company did not have a legal basis to process the personal data of Grindr users in Norway. Grindr is a location-based dating app aimed at gay, bi, trans and queer people. The essence of the infringement was Xandrs participation in so-called real-time bidding, where they acted both on the buyer and seller side. When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem. Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user.

Microsoft is reviewing the decision

The case stems from a complaint filed in 2020 by the Norwegian Consumer Council and privacy organization noyb. Their investigation unveiled how apps shared personal information with advertising technology companies. Grindr had already received a separate fine of 65 million kroner over related violations.

Microsoft said the investigation concerns conduct that predates its acquisition of Xandr. The company emphasized that user privacy remains a priority and confirmed it is reviewing the decision. Xandr has three weeks to appeal the ruling.

A warning for the online advertising industry

The ruling highlights how responsibility for personal data extends beyond the app collecting it. Advertising intermediaries can also face penalties when they process sensitive information without valid consent. For Microsoft, the fine adds another privacy issue to its advertising business. The decision could also put greater pressure on adtech companies to verify consent before handling sensitive user data.