Norway Fines Microsoft-Owned Xandr Over Grindr User Data
The Norwegian Data Protection Authority has fined Xandr Inc. €8.6 million for unlawfully processing personal data relating to Grindr users in Norway. The decision, issued on October 2, 2026, concerns the use of personal data in real-time bidding for online advertising.
The case began in 2020 after the Norwegian Consumer Council complained about the advertising technology practices connected with Grindr, a location-based dating application used by gay, bisexual, transgender, and queer people. Xandr, formerly known as AppNexus and now part of Microsoft, participated in the processing as both a supply-side and demand-side platform.
The Norwegian DPA found that Xandr processed information including the fact that individuals used Grindr, their advertising identifiers, and their IP addresses. According to the authority, this information constituted personal data under Article 4(1) of the GDPR. The fact that a person used Grindr was also treated as information concerning sexual orientation and therefore as special-category personal data under Article 9(1).
Because the processing involved special-category data, Xandr needed a valid exception under Article 9(2) of the GDPR. The relevant exception was explicit consent under Article 9(2)(a), together with a lawful basis under Article 6. Xandr did not obtain consent directly. Instead, it relied on consent collected by Grindr.
The Norwegian DPA concluded that this consent was not valid under the GDPR requirements for consent. The authority also emphasized that accountability cannot be transferred to another organization. Where companies act as joint controllers, each organization must independently verify that consent is valid and sufficiently covers its own processing activities.
The authority considered the infringements at least negligent and particularly serious because they involved core GDPR requirements and sensitive information. The fine covers violations of Article 6(1), relating to the lawfulness of processing, and Article 9(1), relating to the processing of special-category personal data.
The decision is an important reminder for advertising technology companies, publishers, app operators, and other organizations involved in real-time bidding. They cannot assume that consent collected by another participant in the advertising chain automatically protects their own processing. Each organization must assess its role, identify an appropriate legal basis, and confirm that any consent meets the GDPR’s strict requirements.
