Norway fines Microsoft’s Xandr for passing Grindr users’ data through ad auctions

When an app shows you an ad, there’s often an auction happening behind it. In a fraction of a second, information about you and the app you’re using is sent out so advertisers can bid on your attention. On October 2, 2026, Norway’s data protection authority, Datatilsynet, decided that one company running those auctions inside the dating app Grindr broke European privacy law, and fined it NOK 92 million, about €8.6 million.

What the regulator decided

The company is Xandr, formerly AppNexus, now part of Microsoft. According to the European Data Protection Board’s summary of the decision, Xandr processed Grindr users’ personal data during real-time bidding, at least the fact that someone was using Grindr, their advertising ID and their IP address.

Because Grindr is a dating app for gay, bi, trans and queer people, the regulator treated the simple fact that someone uses it as data about their sexual orientation. That is a special category under the GDPR, and it needs explicit consent. Xandr didn’t ask for consent itself. It relied on Grindr’s, and the regulator found that Grindr’s consent wasn’t valid.

The key line from the decision: accountability can’t be outsourced. Each company that handles the data must check for itself that consent is valid and covers what it does. Datatilsynet found Xandr was a joint controller, on both sides of the auction, and that the violations were at least negligent and of high seriousness.

BleepingComputer reports that the conduct ran from July 2018 to April 2020, that the regulator called this its largest fine ever, and that Datatilsynet’s director general, Line Coll, said thousands of users in Norway had their sensitive data shared unlawfully. Xandr had three weeks to appeal. A Microsoft spokesperson told BleepingComputer the case concerned conduct before Microsoft bought Xandr, and that the company was reviewing the decision and assessing its options.

The case began in 2020 with a complaint from the Norwegian Consumer Council; BleepingComputer reports that the privacy group noyb filed it together with the council. Norway’s public broadcaster NRK (in Norwegian) adds two details: Grindr’s privacy policy at the time said it could share information with up to 4,000 other parties, and Xandr deleted its logs shortly after the regulator told it about the investigation, which Xandr says was under its normal routines. Grindr itself was fined NOK 65 million by the same regulator in 2021.

Why this matters to you

Most people never see the ad auctions inside their apps, and that’s why this case matters. Being in an app, at a place, at a time can say something deeply personal on its own, without your name attached. An advertising ID and an IP address can be used to recognize the same device again and again.

Canada’s rules are different from Europe’s, and this decision doesn’t apply here. But the advertising systems are largely the same around the world, so the lesson travels: the less identifying data your phone hands out, the less there is to pass along.

What you can do

1. Limit ad tracking on your phone. On an iPhone, go to Settings › Privacy & Security › Tracking and turn off “Allow Apps to Request to Track.” On Android, you can delete your advertising ID under Settings › Privacy › Ads (the exact path varies by phone).
2. Review location permissions. Apps that don’t need your precise location shouldn’t have it, especially sensitive ones like dating, health or religious apps. Choose “While using” or “Never,” and turn off precise location where you can.
3. Use what the law gives you. In Canada, you can ask a company what personal information it holds about you and who it shares it with. Our Bill C-36 explainer covers what Canada’s proposed privacy law would change.

Sources

• European Data Protection Board, Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data, October 16, 2026
• BleepingComputer, Norway fines Microsoft ad firm $9.6 million over Grindr data sharing, October 12, 2026
• NRK, Rekordgebyr til Microsoft-selskap (in Norwegian), October 12, 2026