Norway Fines Microsoft Subsidiary Xandr $9.6 Million Over Grindr User Data Misuse

Norway Issues Record Fine to Microsoft Adtech Unit

The Norwegian Data Protection Authority (NDPA) has fined Xandr, an adtech subsidiary of Microsoft, 92 million Norwegian kroner, approximately $9.6 million, for allegedly misusing sensitive user data from the dating app Grindr. The penalty is the highest fine the Norwegian authority has issued to date. Xandr has three weeks to appeal the decision.

Alleged Data Sharing Without Consent

According to the NDPA, Xandr allegedly failed to obtain explicit consent to use Grindr users' sensitive personal data for advertising purposes, instead assuming that the dating app had already secured user approval. The authority stated that when a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem. Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user.

Case Origins and Related Actions

The case began in 2020 when Norway's consumer council filed a complaint against Xandr, which was not owned by Microsoft at the time, accusing the company of unlawfully sharing users' personal data for commercial purposes without obtaining consent first. The NDPA justified the high fine by describing the data misuse as very serious and said the penalty was calculated from Xandr's total annual turnover. The infringements took place between July 2018 and April 2020.

While Xandr is the accused party in this case, Grindr has itself faced similar actions. The same Norwegian agency previously charged the dating app with a fine of more than 5.6 million euros, around $6.2 million, for similar reasons. Grindr was also hit with a lawsuit in London in 2024 for allegedly sharing data that included the HIV status and test dates of its users.

Sources: Engadget