Norway has fined advertising intermediary Xandr NOK 92 million for unlawfully processing and sharing data about Grindr users. The sensitive detail did not have to be a message or a profile answer: a device identifier arriving with the fact that someone used Grindr could itself reveal information about sexual orientation.
The Norwegian Data Protection Authority, Datatilsynet, announced the fine on October 12. Its decision is dated October 2 and concerns processing between July 2018 and April 2020. Xandr now belongs to Microsoft, but did not during that period. This is a new enforcement decision about historical advertising practices, rather than an announcement that hackers have just stolen Grindr accounts. [1] [2]
An ad request carried more than an empty advertising slot
The case began with a 2020 complaint by the Norwegian Consumer Council. Technical testing commissioned from security company mnemonic examined data flowing out of the app in 2019. The regulator found that Xandr processed at least three connected pieces: the fact that a person used Grindr, their advertising identifier and their IP address.
Those elements matter together. An advertising ID lets an advertising system distinguish a device; the app context tells it where that device is active. A record does not need a person’s name to become sensitive. Datatilsynet concluded that identifying someone as a Grindr user indicated sexual orientation and brought the information within the GDPR’s special protection for sensitive data.
The next step was real-time bidding: automated requests that let advertising companies compete to show an ad. Xandr participated on both the buying and selling sides. Opening Grindr could therefore start a distribution process involving an advertising intermediary and potentially thousands of other businesses, before the user saw the winning advert. The potential reach is not a verified count of companies that received every individual’s data. [1] [2]
The IP-address safeguard did not match the observed traffic
The 54-page decision contains a revealing discrepancy. Documentation for the MoPub software component described truncating IP addresses for people in the EU and European Economic Area. Yet the technical tests showed the component sending the full IP address to Xandr. That observation appears in the decision’s account of which information Xandr actually received.
This is why the case cannot be reduced to whether a privacy policy mentioned advertising. The investigation followed concrete identifiers across a particular data path. As in research on car apps sharing VINs and location, the useful question is what left the app, which context accompanied it and who received it. Different products and investigations should not be treated as having identical findings. [2]
Relying on the app’s consent was not enough
Xandr said it relied on Grindr to obtain consent. Datatilsynet found that the relevant consent was invalid and that Xandr had not ensured it had a lawful basis for its own processing. The authority considered Xandr a joint controller with Grindr: it had its own responsibility to verify that the permission was valid and covered what it was doing.
The NOK 92 million penalty is Datatilsynet’s highest to date. The authority calculated it using Xandr’s turnover, rather than Microsoft’s, because Microsoft did not own Xandr during the period concerned. Xandr has three weeks from receipt of the decision to appeal. The announcement does not establish that this appeal period has ended or that the decision is beyond challenge. [1]
Current ad choices are a separate check
For people using Grindr now, the practical check is the app’s present advertising preferences. Grindr’s own guidance says these can be changed through Settings → Consent Preference Center; the interface can vary by location. The company says declining personalized advertising still leaves ads in the free version. These are the company’s current instructions, not a regulator’s certification of today’s data flows. [3]
Changing that setting is a decision about current preferences. It does not prove that historical copies held by other companies have been recovered or erased. The distinction is similar to reviewing LG television privacy settings: separate what a service says, what an investigation actually measured and what a setting can control.
The central lesson is specific: app context plus an online identifier can expose sensitive information, and an intermediary cannot treat another company’s consent claim as the end of its own responsibility.
References
- Datatilsynet. Microsoft company fined NOK 92 million. October 12, 2026; accessed October 14, 2026. Regulator’s announcement.
- Datatilsynet. Administrative fine – Unlawful processing of personal data. Decision 20/03541-37, October 2, 2026, pp. 2, 21–25; accessed October 14, 2026. Public decision (PDF).
- Grindr. Building Trust Through Choice: Grindr’s CMP Update for a Better Ad Experience. Published February 26, 2025; updated October 11, 2026; accessed October 14, 2026. Current advertising-preference guidance.
