Norway’s Record Fine Makes Ad Exchanges Own Grindr Consent

Norway’s data protection authority fined Xandr Inc. NOK 92 million (€8.6 million) for running Grindr user data through live ad auctions. Datatilsynet published the decision on 12 October 2026 and called it the highest fine it has issued to date.

The bill lands on a Microsoft subsidiary. The legal finding lands on every firm that sat in the bid stream: Xandr was a joint controller with Grindr and had to check explicit consent itself. It did not.

The Auction Treated Grindr Use as a Profile Flag

Xandr sat in the middle of real-time bidding inside the free Grindr app. When someone opened the app, personal data often moved through Xandr so advertisers could bid, in a fraction of a second, to show that person an ad. Line Coll, director general of Datatilsynet, said the traffic was hidden from the user.

The decision, dated 2 October 2026, finds it proven that Xandr processed at least three items: the fact a person was using Grindr, that person’s advertising ID, and IP addresses. Being on Grindr is treated as data about sexual orientation, which Article 9 of the GDPR specially protects. Borgarting Court of Appeal had already said the same thing in the Grindr case.

Xandr confirmed it received bid requests for Norwegian Grindr users and used that data to show ads. Grindr’s free app carried advertising software kits, including MoPub, which collected data and passed requests to other firms. Xandr also received data more directly. In the authority’s view, Xandr acted on both the seller side and the buyer side of the auction.

WHAT LEFT THE APP

• App use: The fact that a person was on Grindr, which the authority treats as sexual-orientation data.
• Advertising ID: A mobile identifier that lets firms recognise the same device across apps.
• IP address: A network address that can locate a session and link it to other records.

Coll said that once those points leave the phone, it is hard to know where they end up or how they get combined. The authority says the data reached potentially thousands of companies. It also says thousands of users in Norway were exposed.

Why Xandr Could Not Lean on Grindr’s Consent

Special-category data needs explicit consent under Article 9(2)(a). Xandr did not collect that consent. It assumed Grindr had, and it did not test whether Grindr’s wording was valid for Xandr’s own processing.

Our key message is that responsibility for data protection cannot be passed on to others. Each and every company must itself ensure, and be able to document, that they process personal data lawfully. This case also demonstrates how opaque the advertising ecosystem is for individuals. When companies do not take responsibility and blame each other, the rights of users become, in practice, worthless.

Line Coll, Director General, Norwegian Data Protection Authority

The administrative fine of NOK 92 million rests on two breaches: processing without a legal basis under Article 6(1), and processing sexual-orientation data without a valid exemption under Article 9(1). Grindr’s older consent tool failed Articles 4(11) and 7, the authority had already held, because the consent was not freely given, specific, informed, or unambiguous. Xandr still relied on it.

Accountability, the decision says, cannot be outsourced. Each joint controller must check that consent is valid and that it covers that firm’s own use. The infringements were at least negligent, and the authority ranks them as highly serious because they go to the centre of the GDPR and to sensitive data.

A direct financial benefit from the sharing weighed heavily in the amount, as did the length of the practice. The investigation window is 20 July 2018 to 7 April 2020, which Datatilsynet calls almost two years. GDPR took effect in Norway on 20 July 2018. Grindr put a new consent tool in front of Norwegian users on 8 April 2020, so the probe stops the day before.

Microsoft Bought Xandr After the Conduct Stopped

AT&T closed its purchase of AppNexus Inc. on 15 August 2018. The company was renamed Xandr Inc. on 1 July 2019. Microsoft announced a deal to buy Xandr on 21 December 2021 and completed the acquisition of Xandr on 6 June 2022, more than two years after the last day in the file.

Datatilsynet calculated the penalty on Xandr’s own worldwide annual turnover. Microsoft’s turnover was not used, the authority said, because Xandr was not part of Microsoft in the period under review. Xandr also had no “main establishment” in the EEA then, so Norway could act without the one-stop-shop process that would have routed the file through another European regulator. Later ownership by Microsoft does not create that establishment after the fact.

A Microsoft spokesperson said user privacy is a top priority, and that the investigation and the decision “focused on conduct that predates Microsoft’s acquisition of Xandr.” The spokesperson added that legal frameworks, and the way regulators read and apply them, have changed since then, and that Microsoft is reviewing the decision and assessing its options. Xandr has three weeks from receipt of the decision to appeal.

That timing is the inheritance argument, and it is true as far as it goes. It does not touch the joint-controller holding, which is written as a rule for whoever sits in the auction, not as a verdict on Redmond’s later purchase.

The Complaint Waited Six Years for This Fine

The Norwegian Consumer Council, Forbrukerrådet, sent Datatilsynet complaints against Grindr and five adtech companies on 14 January 2020, working with the Austrian group noyb. The work sat inside the Council’s “Out of Control” project, which more than 42 organisations joined. Mnemonic ran the technical tests. Researcher Wolfie Christl of Cracked Labs mapped the ad trade. Max Schrems and noyb shaped the legal filings.

FROM COMPLAINT TO RECORD FINE

1. 20 July 2018: GDPR takes effect in Norway, and the investigation window opens.
2. 14 January 2020: The Norwegian Consumer Council and noyb file complaints against Grindr, AppNexus/Xandr, MoPub, OpenX, AdColony and Smaato.
3. 7 April 2020: The last day of the Xandr probe; Grindr’s new consent tool for Norway starts the next day.
4. December 2021: Datatilsynet fines Grindr NOK 65 million, cut from a notified NOK 100 million.
5. 6 June 2022: Microsoft completes its purchase of Xandr from AT&T.
6. September 2023: The Privacy Appeals Board upholds the Grindr fine in full.
7. 21 October 2025: Borgarting Court of Appeal upholds the Grindr fine after a hearing on 12-14 August 2025; the judgment becomes final on 26 November 2025.
8. 3 April 2025: Datatilsynet sends Xandr an advance notice of a fine; Xandr replies on 2 June 2025.
9. 2 October 2026: The Xandr decision is dated; Datatilsynet publishes it on 12 October 2026.

Finn Lützow-Holm Myrstad, director of digital policy at the Norwegian Consumer Council, said none of Grindr’s users would even know Xandr existed, “let alone be able to understand how the company used their personal data.” He added that when firms that receive data through the ad system become joint controllers, it is hard to see how today’s tracking-based advertising can be lawful if consent is to be genuine.

noyb called the outcome a major blow to the online adtech industry. Felix Mikolasch, a data protection lawyer at noyb, said online adtech firms “often operate in the background and are rarely held accountable for their practices,” and that the decision “sets a valuable precedent for similar cases.” Profiling people’s interests, habits, location and behaviour, noyb said, requires valid consent, which those firms hardly ever obtain.

MoPub, OpenX, AdColony and Smaato Still Sit in the File

The 2020 complaints did not stop at Grindr and Xandr. The Consumer Council also named four other advertising firms that received data through the app. Datatilsynet’s Xandr decision records complaints against Grindr, Xandr, and four other adtech companies. It decides only Xandr’s case.

FIRMS NAMED IN THE 2020 COMPLAINTS

• AppNexus / Xandr Inc.: Fined NOK 92 million as a joint controller for bid auctions in the free Grindr app.
• MoPub: Advertising software inside Grindr that collected data and managed requests from other firms, including Xandr.
• OpenX: Named in the same Consumer Council and noyb filings; no public Norwegian fine in this decision.
• AdColony: Named in the same filings; no public Norwegian fine in this decision.
• Smaato: Named in the same filings; no public Norwegian fine in this decision.

Coll’s line that firms cannot blame one another is the part that travels. If every recipient in the bid path must prove its own legal basis, a publisher’s consent screen is no longer a shield for the exchange, the bidder, or the software kit that opened the pipe.

WHAT WE KNOW

• Xandr’s fine: NOK 92 million for Articles 6(1) and 9(1), with three weeks from receipt to appeal.
• Grindr’s fine: NOK 65 million, upheld through the Privacy Appeals Board, Oslo District Court and Borgarting Court of Appeal, and final as of 26 November 2025.
• The other four: MoPub, OpenX, AdColony and Smaato were complained against in 2020 alongside Xandr.

WHAT IS UNCONFIRMED

• Microsoft’s next step: The company has said it is reviewing the decision and has not said whether it will appeal.
• The other four files: Datatilsynet has not published fines against MoPub, OpenX, AdColony or Smaato in this notice.
• A user headcount: The authority says thousands of Norwegian users were affected; it does not give a precise number in the public notice.

Grindr markets itself as the largest social network for gay, bi, trans and queer adults and states that it has more than 13 million monthly active users worldwide. That global figure is Grindr’s claim. The Norwegian case is about users in Norway during the investigation window, not the worldwide base.

Grindr Already Lost the Same Fight in Court

Xandr’s file is the second half of a case the app already lost. Datatilsynet fined Grindr NOK 65 million in December 2021 for disclosing user data to advertising partners without a valid legal basis, after first notifying a NOK 100 million penalty and then cutting it on finances and changes to Grindr’s consent tool. The data in that case included GPS location, IP address, advertising ID, age, gender, and the fact the person was on Grindr.

Grindr appealed. The Privacy Appeals Board upheld the fine in September 2023. Oslo District Court upheld it in 2024. Borgarting Court of Appeal rejected Grindr’s appeal on 21 October 2025 and kept the NOK 65 million penalty. Datatilsynet said on 26 November 2025 that the judgment was not appealed further and is final. Coll called that court result fundamental for the right to data protection, after three rounds of appeals.

TWO FINES, ONE BID STREAM

The Xandr penalty is larger because the authority applied Xandr’s turnover and treated the firm as a large, leading actor whose business is the processing of personal data. It is not a combined total with Grindr’s fine. Each company was fined for its own processing.

For people who used the free app in Norway between 20 July 2018 and 7 April 2020, the ruling does not change a setting on their phone. It records that sexual-orientation data moved through an auction they never saw, to firms they never heard of, on a consent Xandr never checked. Microsoft now holds the entity that ran that pipe, and it has three weeks from receipt to decide whether to fight the largest fine Datatilsynet has ever issued.