Microsoft Unit Fined £7.3M for Exposing Grindr Users' Sexual Orientation Data to Thousands of Advertisers

Norway's data protection regulator has fined Microsoft-owned advertising technology company Xandr 92 million Norwegian kroner (about £7.3 million or $9.6 million) for unlawfully processing and sharing sensitive personal data linked to users of dating app Grindr.

The Norwegian Data Protection Authority, Datatilsynet, said on 12 October that Xandr had relayed information revealing users' sexual orientation to potentially thousands of companies through automated advertising auctions between July 2018 and April 2020.

The regulator rejected Xandr's argument that it could rely on Grindr to obtain users' consent, finding that the advertising company had its own legal responsibilities for processing the information. The penalty is the largest Datatilsynet has issued to date.

Regulator Rejects Xandr's Consent Argument

The investigation followed a 2020 complaint by the Norwegian Consumer Council and privacy organisation noyb, which raised concerns about how personal information from dating apps was shared with advertising technology companies. Xandr, formerly known as AppNexus, was among five advertising businesses named in complaints concerning Grindr and other intermediaries.

The case centred on real-time bidding, an automated system in which advertisers compete to place adverts in apps and websites. When someone opened Grindr, personal information could be transmitted through the advertising process to companies seeking to deliver targeted adverts. These transactions happen in fractions of a second, often without users knowing which businesses may receive their information.

Unlawful Sharing of Sensitive Information

Datatilsynet said information identifying someone as a Grindr user could itself reveal their sexual orientation. Such information receives special protection under data protection law, and the authority concluded that explicit consent was required for the processing in this case.

Xandr argued that it assumed Grindr had obtained the necessary consent. The regulator rejected that defence, finding that the companies were joint data controllers and that Xandr had its own obligation to establish a lawful basis for processing the data.

Datatilsynet director general Line Coll said the breaches were 'very serious' and that thousands of users in Norway had been subjected to unlawful sharing of sensitive information.

Fine Based on Xandr's Turnover

The authority said the violations continued for almost two years. It considered their seriousness and the financial benefit to Xandr when setting the penalty.

The fine was calculated using Xandr's own annual turnover, not Microsoft's, because Microsoft did not own the business during the period under investigation. Microsoft acquired Xandr in 2022. The company has three weeks from receiving the decision to appeal.

The decision follows a 65 million kroner (about $6.8 million, or £5.1 million) fine imposed on Grindr in 2021 over related data protection breaches. Norway's Court of Appeal upheld that penalty in 2025, according to the Norwegian Consumer Council. The current case focuses on the responsibilities of the advertising technology company that processed the data.

Microsoft Reviews the Decision

Microsoft said user privacy remained a priority and stressed that the investigation concerned conduct predating its acquisition of Xandr. The company said: 'This investigation and decision focused on conduct that predates Microsoft's acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing the decision and assessing our options.'

Privacy organisation noyb welcomed the ruling, describing it as a valuable precedent for holding advertising technology companies accountable for their handling of personal data.