Norway’s data protection authority has fined Microsoft-owned advertising company Xandr 92 million kroner, about €8.5 million, after concluding that it unlawfully processed information about users of the dating app Grindr.
The penalty is the largest imposed by the Norwegian authority. It follows a complaint brought in 2020 by the Norwegian Consumer Council and privacy group noyb, which traced how information from mobile apps moved through the advertising market. The investigation concerned data handled between July 2018 and April 2020, before Microsoft acquired Xandr.
The regulator’s decision reaches beyond the company that first collected the information. Xandr argued that Grindr was responsible for obtaining users’ consent before data entered the advertising system. The authority rejected that separation of responsibility, finding that an advertising intermediary receiving and using personal data must have its own basis for believing the processing is lawful.
The material at issue could reveal sensitive aspects of a person’s life, including the use of an app directed at gay, bisexual, transgender and queer users. In the automated advertising market, identifiers and profile information can pass through a chain of companies that the individual has never heard of. The Norwegian decision treats that distance from the user as a reason for scrutiny, not a shield from it.
Xandr is now part of Microsoft Advertising. Microsoft said it was reviewing the decision. The fine is an administrative sanction rather than a court judgment, and any challenge would proceed through Norway’s review system.
The same investigation previously produced a 65 million kroner penalty against Grindr. That decision was upheld on appeal in Norway. The Xandr ruling extends the enforcement theory from the app to a company operating deeper in the advertising infrastructure.
Norwegian Consumer Council announcement
