- Norway’s Data Protection Authority fined Xandr, now part of Microsoft, NOK 92 million, the highest fine it has issued. [1]
- The decision, dated October 2, 2026, covers bid requests about Grindr users in Norway from July 20, 2018 to April 7, 2020. [2]
- Xandr was found to be a joint controller with Grindr in both of its roles, as supply-side and as demand-side platform. [2]
- The data were the fact of using Grindr, the advertising ID, and the IP address. Together they count as data concerning sexual orientation. [2]
- Contract clauses that left consent to Grindr did not help. The decision says: “Compliance can never be outsourced.” [2]
- The fine was calculated on Xandr’s own turnover, not Microsoft’s, with a legal maximum of €20 million. [2]
- Xandr has three weeks from receipt to appeal. [1]
On October 12, Norway’s Data Protection Authority, Datatilsynet, announced a fine of NOK 92 million against Xandr, the ad exchange formerly called AppNexus and owned by Microsoft since 2022. [1] The decision converts the amount to approximately €8.5 million. The press release says €8.6 million. [2][1]
The headline is the amount. The part that will be read in legal and product teams is the reasoning, because Xandr did not collect the data from anyone’s phone. It stood in the middle of an auction, with contracts saying consent was someone else’s job.
What Xandr handled
The case began on January 14, 2020, when the Norwegian Consumer Council filed complaints about the free version of the Grindr app and the advertising companies it sent data to, AppNexus among them. [3][2] Grindr itself was fined NOK 65 million in December 2021, and that fine survived the appeals board, the district court, and in October 2025 the Borgarting Court of Appeal. [4]
In the Xandr decision, the authority finds it proven by a clear preponderance of probability that Xandr processed at least three things about Grindr users: the fact that they were using Grindr, their advertising ID, and their IP address. [2] An ad request reached Xandr’s platform either directly from Grindr or through MoPub, the mediation service then owned by Twitter. Xandr could enrich it with segment and contextual data and send a bid request to its own demand-side platform and to others. [2]
Two details show how far the data could travel. At the time, Xandr’s list of third-party providers “included more than 4000 companies.” [2] Microsoft’s current version of that list, last updated on September 17, holds about 2,000 names in four groups by our count. [5] And although MoPub’s documentation said its software truncated the IP addresses of European users, the technical testing behind the complaint “showed that the MoPub SDK was transmitting the full IP address to Xandr.” [2]
The authority treats the name of the app as the sensitive part. Being a Grindr user, it says, “strongly indicates” belonging to a sexual minority, so an app name next to an identifier is special category data under Article 9 of the GDPR, which in this case could be processed only with explicit consent. [2]
Seven defenses and the answers
Xandr accepted that it was a joint controller when its own buying platform bid on Grindr inventory. It argued that as a supply-side platform it was partly a controller and partly a processor acting on Grindr’s instructions. [2] The decision goes through its arguments one at a time.
| What Xandr argued | What the authority answered |
|---|---|
| As the seller’s platform it followed Grindr’s instructions, given through settings in its console. | Xandr built the console and its defaults. “Where Grindr did not tweak the settings in the Console, the bid request would be circulated according to the standards selected by Xandr to the recipients that Xandr had partnered up with.” |
| Its master services agreement prohibited Grindr from sharing special category data. | The clause shows Xandr did instruct Grindr on categories of data. A contractual commitment “does not relieve Xandr of its responsibility, when it de facto processed sensitive personal data.” |
| Grindr was contractually obliged to obtain valid consent. | Each joint controller needs its own legal basis. Xandr “did not take any measures” to verify that consent was valid and covered its processing. |
| It would have been unfeasible to check a customer’s legal basis. | Having no contact with users and sitting further down the chain, Xandr “had all the more reason to check and ensure lawfulness.” |
| The app, device, and user fields are only recommended in the OpenRTB protocol, so the authority should assume they were not sent. | The fields are “not strictly technically required,” but they are “integral to making the services profitable.” |
| The data no longer exist. They were deleted under its retention policy. | Xandr knew of the investigation from February 21, 2020, and deleting potential evidence after an investigation has begun “cannot be invoked” in its favor. |
| Nobody in the market treated app use as sensitive data at the time. | That reading “appears to have no support in legal sources,” court rulings apply retroactively, and industry practice is not a mitigating factor. |
Every quotation in the table is from the decision. [2]
One passage explains why the authority would not accept the processor label. Grindr, for its part, had told the regulator that it and Xandr did “not have a controller-processor relationship” for this data. [2] So Xandr said Grindr was in charge, and Grindr said it was not. In the decision’s words, “neither Grindr nor Xandr considered itself as a controller for the processing in question,” which left users with nobody to send a request to. [2]
“Our key message is that responsibility for data protection cannot be passed on to others. Each and every company must itself ensure, and be able to document, that they process personal data lawfully.”
Line Coll, Director General, Norwegian Data Protection Authority [1]
How the amount was set
The GDPR caps fines for these breaches at €20 million or 4% of worldwide annual turnover, whichever is higher. The decision says €20 million was the higher figure for Xandr, which implies a turnover below €500 million. The turnover itself is redacted. [2] The fine is about 43% of that maximum, by our arithmetic from the decision’s figures.
Microsoft’s turnover was left out on purpose. Microsoft acquired Xandr on June 6, 2022, after the period in question, so it “was not in a legal or factual position to exercise decisive influence” at the time, and the authority pointed to an EU competition ruling on fines for conduct that predates an acquisition. [2]
The decision lists what pushed the amount up: the nature and duration of the breach, the absence of any verification measures, the sensitivity of the data, and the financial benefit, since sharing the data is how Xandr earned money on the transactions. Two things pulled it down. Xandr attended a voluntary meeting, which counted “slightly,” and the case took a long time. [2] From complaint to decision is 2,453 days by our count, and the advance notice of the fine went out on April 3, 2025, a year and a half before the decision. [2]
The number of people affected played no part. The press release speaks of thousands of users in Norway, but the decision says the authority could not establish how many bid requests Xandr handled and so placed no weight on the figure. [1][2]
What carries over, and what does not
Three limits first. The decision can be appealed within three weeks, and the next stop would be the Privacy Appeals Board. [2] It covers users in Norway only, and says it is “without prejudice to the competence of GDPR supervisory authorities in other EEA territories.” [2] And it makes no finding about advertisers, or about Grindr and MoPub in this case. [2]
Within those limits, the reasoning is not specific to one app. It leans on the EU Court of Justice’s 2024 ruling that IAB Europe is a joint controller for the consent strings its framework circulates in real-time bidding, a ruling that put responsibility on a body that designs part of the auction’s infrastructure. [6][2] The Norwegian decision applies the same idea to an exchange: a platform that sets the defaults has made a decision about the data.
For a company in the middle of the chain, the decision reads as a list of things that did not count:
- A clause that obliges the publisher to collect consent. The authority calls this not “an adequate measure.” [2]
- A clause that forbids sensitive data, with no check on what arrives.
- A privacy policy that says the company normally relies on legitimate interests and in some cases on consent. The authority found that too vague to identify a legal basis. [2]
- A retention schedule that keeps running after a regulator has written to you.
For buyers, the practical point is narrower. Inventory in apps whose name alone says something about health, religion, politics, or sexuality carries Article 9 risk in the bid request itself, whatever targeting you apply. Which legal basis the data rests on is the question we covered in our guide to legal bases in advertising, and this decision adds that somebody in the chain is expected to have checked.
Sources
- Datatilsynet · Microsoft company fined NOK 92 millionPrimary. Press release, October 12, 2026.
- Datatilsynet · Administrative fine: Unlawful processing of personal data (redacted public version)Primary. Decision 20/03541-37, October 2, 2026, 54 pages. Turnover figures are redacted.
- Forbrukerrådet · Out of control: Complaints and follow upPrimary. The Norwegian Consumer Council’s complaints of January 14, 2020.
- Datatilsynet · The Court of Appeal upholds the fine against GrindrPrimary. October 21, 2025.
- Microsoft Learn · Third party providersPrimary. Xandr’s current partner list, last updated September 17, 2026. The count is ours.
- Court of Justice of the European Union · Press release No 44/24: Judgment of the Court in Case C-604/22, IAB EuropePrimary. March 7, 2024.
Frequently asked questions
Why was Xandr fined?
Norway’s Data Protection Authority found that Xandr processed personal data of Grindr users in Norway without a legal basis, in breach of Article 6(1) of the GDPR, and processed data concerning sexual orientation without a valid exemption, in breach of Article 9(1). The processing took place in real-time bidding between July 20, 2018 and April 7, 2020.
How large is the fine?
NOK 92 million. The decision converts that to approximately €8.5 million at the exchange rate it uses, and the authority’s press release gives €8.6 million. The authority calls it the highest fine it has issued to date.
Which data did the regulator say Xandr processed?
At least three things: the fact that a person was using Grindr, the device’s advertising ID, and the IP address. The authority held that the app’s name next to an identifier is data concerning sexual orientation, a conclusion Norwegian courts had already upheld in the case against Grindr itself.
Was the fine based on Microsoft’s revenue?
No. Microsoft acquired Xandr on June 6, 2022, after the period under investigation, so the authority based the calculation on Xandr’s own turnover. Because 4% of that turnover was below €20 million, the legal maximum was €20 million.
Did Xandr’s contract with Grindr matter?
Not in Xandr’s favor. Xandr pointed to a clause prohibiting Grindr from sharing special category data and to Grindr’s contractual duty to obtain consent. The authority said a contractual commitment does not relieve a controller of responsibility, and that Xandr took no measures to verify that the consent was valid.
Is the decision final?
No. Xandr has three weeks from receiving the decision to appeal. If the authority upholds its decision, the case goes to the Norwegian Privacy Appeals Board. The decision covers only users in Norway and says it is without prejudice to the competence of supervisory authorities in other EEA countries.
Does the decision say anything about advertisers?
It makes no finding about advertisers, and it says the authority made no legal assessment of Grindr or MoPub in this case. Its reasoning concerns the platforms that carry bid requests between a publisher and buyers.
Mikołaj Salecki
Writes about media, tech, and AI business for people who actually run digital. Former agency lead. Skeptic of frameworks that read better than they perform.
