Norwegian Data Protection Authority Imposes Fine on Xandr
The Norwegian Data Protection Authority Datatilsynet has imposed an administrative fine on Xandr Inc. in the amount of EUR 8.6 million. In nominal terms, the sanction amounts to NOK 92,000,000. According to the authority, this is the highest fine Datatilsynet has issued to date.
The subject of the proceedings was the processing of personal data of users of the dating app Grindr in connection with real-time bidding. The app is aimed in particular at gay, bisexual, trans, and queer people. The decision is dated 2 October 2026 and was published on 12 October 2026.
According to the available information, Xandr may file an objection within three weeks of receiving the decision. The decision should therefore not yet be regarded as final and binding.
Origin of the Proceedings and Companies Involved
Complaints by the Norwegian Consumer Council
The proceedings originated from complaints that the Norwegian Consumer Council Forbrukerrådet filed with Datatilsynet on 14 January 2020. The complaints were lodged under Art. 80(1) GDPR (General Data Protection Regulation) on behalf of a data subject.
The complaints were directed against Grindr as well as against several companies in the advertising technology sector. The companies named included:
- MoPub, then associated with Twitter,
- AppNexus, now Xandr,
- OpenX,
- AdColony,
- Smaato.
The complaint directed against Xandr originally concerned AppNexus Inc. Xandr now operates under the name Microsoft Advertising. Microsoft acquired Xandr in 2022.
Technical Basis of the Complaint
The complaint was based, among other things, on an investigation of data flows in the Grindr app. According to the available information, this investigation was carried out for the Consumer Council by the security company mnemonic and covered the period from 8 July to 31 December 2019.
As early as 21 February 2020, Datatilsynet requested information from Xandr regarding cross-border processing. Upon request, the deadline was extended from 16 March 2020 to 17 July 2020. Xandr responded on 16 July 2020.
Between the receipt of the complaints on 14 January 2020 and the date of the decision on 2 October 2026, 2,453 days elapsed.
Findings of the Authority on Data Processing
Processing in the Context of Real-Time Bidding
Datatilsynet concluded that it had been proven with a clear preponderance of probability that Xandr processed personal data of Grindr users in the context of real-time bidding. According to the authority’s assessment, this concerned at least the information that a person used Grindr, as well as advertising IDs and IP addresses.
The authority assessed this information as personal data within the meaning of Art. 4 No. 1 GDPR. At the same time, Datatilsynet classified the data concerned as information relating to sexual orientation within the meaning of Art. 9(1) GDPR.
According to the authority, the data disclosure took place in connection with real-time auctions to potentially thousands of companies. According to the authority, users outside Norway were also affected. However, the decision against Xandr concerns the processing of personal data of Grindr users in Norway.
Period of the Contested Processing
According to the available information, the infringement period on which the authority based its decision lies between July 2018 and April 2020. Following evaluation of the decision, it specifically covers the period from 20 July 2018 to 7 April 2020.
The relevant period therefore preceded Microsoft’s acquisition of Xandr in 2022. Microsoft stated in this regard that the conduct objected to occurred before the acquisition of Xandr; it also stated that the decision was being reviewed.
Legal Assessment by Datatilsynet
Joint Controllership of Xandr
Datatilsynet classified Xandr as a joint controller for the processing. According to the authority’s assessment, this applied both to its role as a supply-side platform and to its role as a demand-side platform.
The authority took the view that explicit consent pursuant to Art. 9(2)(a) GDPR was required for the processing of special categories of personal data. In addition, a legal basis for the processing of personal data was required under Art. 6(1) GDPR.
Consents Invalid According to the Authority
According to the authority’s findings, Xandr did not obtain its own consents, but relied on consents that Grindr was said to have obtained from users. However, Datatilsynet assessed these consents as invalid within the meaning of Art. 4 No. 11 and Art. 7 GDPR.
In the authority’s view, the consents were invalid, among other reasons, because users had not been sufficiently informed. According to the available information, Xandr defended itself by arguing that it had assumed Grindr had obtained the necessary consents. Datatilsynet rejected this submission.
In this context, the authority made clear that accountability obligations could not be outsourced. Each joint controller must independently verify whether consent is valid and covers its own processing.
Contractual Terms as an Attempted Justification
On 25 August 2023, Xandr submitted contractual terms to the authority. In doing so, the company relied, among other things, on Clause 9(a) of the IDA. However, Datatilsynet did not consider this to be a viable basis for justifying the contested processing without valid consent.
According to the authority’s assessment, there were infringements of Art. 6(1) GDPR and Art. 9(1) GDPR. The authority assessed the infringements as at least negligent.
Amount of the Fine and Assessment
Key Considerations of the Authority
Datatilsynet assessed the established infringements as serious. By way of reasoning, the authority stated that core requirements of the GDPR were affected and that the processing involved sensitive data.
According to the available information, the Director of Datatilsynet, Line Coll, justified the amount of the fine, among other things, on the basis that the established infringements were very serious and that thousands of users in Norway had been affected.
Following evaluation of the decision, the aggravating assessment factors taken into account in particular were:
- the nature, gravity, and duration of the infringements,
- the degree of responsibility,
- the categories of data concerned,
- a financial benefit.
As a mitigating factor, the authority took particular account of cooperation in the form of voluntary participation in a meeting in February 2025.
Fine Range and Basis of Calculation
The public version of the decision comprises 54 pages. According to the available information, the fine range was EUR 20 million or approximately NOK 215.8 million, because four percent of Xandr’s turnover was below that amount. The specific turnover is redacted in the published version.
According to the available information, the amount of the fine was calculated on the basis of Xandr’s turnover. The turnover of the Microsoft group was expressly not taken into account.
Context in Relation to Earlier Proceedings
Following a corresponding complaint by Forbrukerrådet, Datatilsynet had already previously imposed a fine of NOK 65 million on Grindr itself. That decision is dated 15 December 2021.
By contrast, the proceedings against Xandr concern the role of the advertising technology company in the processing of data in the context of real-time bidding. The authority’s findings relate to the specific processing of personal data of Grindr users in Norway and to the lack, in the authority’s view, of a valid legal basis for this processing.
Significance for Data Protection and Digital Advertising
The decision shows that data protection authorities require an independent assessment of responsibilities and legal bases in data-driven advertising models. This applies in particular where special categories of personal data within the meaning of Art. 9(1) GDPR may be concerned.
For companies with digital advertising structures, platform models, or data disclosures to multiple parties, the decision may have considerable practical relevance. However, the specific circumstances of each individual case remain decisive, in particular the concrete allocation of roles, the type of data, the information available to the data subjects, and the legal basis relied upon in each case.
MTR Legal Rechtsanwälte advises companies, investors, and high-net-worth private individuals on data protection law issues in national and international contexts. In the event of legal questions concerning data processing, consents, responsibilities, or authority proceedings, individual advice in the area of legal advice on data protection law from MTR Legal may be advisable.
