Norway's privacy regulator has imposed its largest-ever fine after finding that advertising intermediary Xandr unlawfully processed and relayed sensitive Grindr user data. The Norwegian Data Protection Authority set the penalty at NOK 92 million, about €8.6 million, and said information revealing users' sexual orientation could have reached potentially thousands of companies through automated advertising auctions.
The decision matters beyond one dating app. Xandr argued that it believed Grindr had collected consent. The regulator rejected that defense, found the companies jointly responsible for the processing and said every participant must verify and document that it has a lawful basis to use the data it receives. In other words, an ad exchange cannot turn consent into somebody else's homework.
A fraction of a second, thousands of recipients
Real-time bidding is the machinery that chooses many online ads. When an app or webpage opens, data about the available impression can be sent into an automated auction. Advertising platforms compare bids and select a winner fast enough for the ad to appear with the page. That speed does not make the accompanying data harmless or anonymous by default.
According to the regulator, Xandr operated on both the buyer and seller sides of auctions involving Grindr. The data flow included the fact that a person used a location-based service aimed at gay, bi, trans and queer people. That alone can reveal sexual orientation, a specially protected category under European privacy law. The authority said explicit consent was required, but Xandr did not verify that Grindr's consent was valid or establish another legal basis for its own processing.
The conduct ran from July 2018 to April 2020. Its duration, the sensitivity of the information and Xandr's financial benefit all increased the penalty. The fine was calculated from Xandr's turnover rather than Microsoft's because Microsoft did not own the company during the period at issue. Xandr has three weeks from receipt of the decision to appeal.
The precedent is aimed at the middle
The case began with a 2020 complaint based on the Norwegian Consumer Council's investigation of data sharing across the mobile advertising industry. The council says it complained about Grindr and five advertising technology companies, including Xandr, then known as AppNexus. Norway previously fined Grindr NOK 65 million for related breaches.
The new ruling shifts the focus downstream. Apps are the visible front doors, but brokers, exchanges and bidders make the tracking economy function. Norway's message is that those intermediaries are not passive pipes when they decide how personal data moves, who receives it and how an auction uses it. Reuters reports that Microsoft is reviewing the decision and assessing its options; the company also emphasized that the conduct predated its acquisition of Xandr.
That is the strongest limitation on the immediate corporate conclusion. The ruling concerns practices that ended more than six years ago, it can still be appealed and it does not show that Microsoft's current advertising systems repeat the same conduct. Nor does a record fine by one national regulator automatically settle how every European authority or court will treat every participant in a modern bidding chain.
TINA's view: consent needs a chain of custody
TINA's view: Norway has identified the right failure point. Sensitive data does not become less sensitive when it passes from a recognizable app into invisible advertising infrastructure. If an intermediary profits from receiving and redistributing it, that intermediary should be able to prove where consent came from, what it covered and why each recipient needed the information.
This judgment would weaken if an appeal shows that Xandr neither controlled the relevant purposes nor had a practical way to verify the consent signal. It would strengthen if other regulators apply the same joint-responsibility reasoning to additional exchanges, supply-side platforms or bidders. The signal to watch is not merely whether Xandr pays NOK 92 million. It is whether adtech companies begin refusing sensitive auction traffic unless consent arrives with an auditable chain of custody.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
