Skip to content
Today
Sections

Invest Widely confirmed7 publishers 2 min read Published Updated

Norway fines Microsoft-owned Xandr 92 million crowns over Grindr users' data shared with advertisers

Norway's data protection authority fined Microsoft's adtech unit Xandr 92 million crowns ($9.6 million) over Grindr data, the largest penalty it has issued. The fine is 1.4 times the 65 million crowns imposed on Grindr itself over the same breaches.

The Investor · Invest desk

Send a correction

Xandr fined years after its Grindr relay ended Grindr's 2021 fine over the same breaches, time from the April 2020 end of conduct to Xandr's fine, the relay period, and Xandr's appeal window.

Key figures: the data protection authority fined Grindr 65 million crowns over the same breaches in 2021. Xandr's fine came about 6.5 years after the conduct ended in April 2020, after roughly 21 months of conduct. Xandr has three weeks to appeal.

Xandr fined years after its Grindr relay ended
FigureValueNoteClaim
Grindr's own fine over the same breaches, 202165 million crowns6
Conduct end to fine, about6.5 years20
Conduct period, roughly21 months23
Time Xandr has to appeal3 weeks14

What happened

  • Xandr relayed data revealing the sexual orientation of Grindr users to companies in automated ad auctions from July 2018 to April 2020.
  • Xandr said it assumed Grindr had obtained users' consent and never checked, the authority said, and the authority ruled that Xandr shared legal responsibility with Grindr.
  • The fine was based on Xandr's revenue, not Microsoft's, because Microsoft did not own the unit at the time.
  • The case began with a 2020 complaint from the Norwegian Consumer Council and the Austrian privacy group noyb.

Why it matters

  • What it costs cost Conduct that ended in April 2020 drew its fine about 6.5 years later, a gap a buyer of any adtech business has to price into diligence.
  • Who's exposed exposure Thousands of advertisers received the Grindr data. If each company needs its own legal basis, as the authority holds, every one of them is as reachable as the relay.
  • Who has to decide decision Appealing means contesting the shared-responsibility finding, the part of the decision that applies beyond this fine. Not appealing leaves it standing.
  • What it sets up precedent How far the ruling travels depends on Brussels: noyb, which called it a valuable precedent, warns it could lose its effect if the Digital Omnibus weakens the GDPR.

Datatilsynet's reasoning fits in one sentence. "Responsibility for data protection cannot be delegated to others," Director General Line Coll said in the authority's statement, as quoted by Tech Xplore [8]. According to Cryptopolitan's account, she added that each company must independently ensure, and be able to demonstrate, that it has a legal basis for the data it procures [9]. The authority describes real-time bidding as a sale of ad space in milliseconds as a user opens an app, with the user's data potentially reaching thousands of companies [10]. We think a legal basis that has to be demonstrable for each of those recipients cannot be assembled by hand at that speed, so the working consequence is a consent check inside the bidder's own systems.

Microsoft's answer rests on timing. "This investigation and decision focused on conduct that predates Microsoft's acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing the decision and assessing our options," Microsoft said [12]. The evolving-standards point has two rulings against it, though neither involved Xandr. Norwegian courts upheld the 65 million crown fine on Grindr in 2025 [7], and the Conseil d'Etat upheld a 40 million euro fine on Criteo earlier in 2026, rejecting Criteo's claim that partner websites were responsible for collecting consent [18]. A Norwegian appeal body has not ruled on Xandr. A reversal of the shared-responsibility finding would undo our reading for Norway, and a payment with no appeal would leave the finding standing.

Against the $3.97 trillion GuruFocus puts on Microsoft [15], $9.61 million is roughly 0.00024 percent [19], or rather 0.00024 percent of a valuation Cryptopolitan took from a single data site. For a bidder the more useful unit is time: 92 million crowns over roughly 21 months of conduct is about 4.4 million crowns, or $458,000, a month [23]. That unit is crude, because the authority also weighed Xandr's direct financial benefit from the sharing [11]. The sources do not put a cost on verifying consent, so whether $458,000 a month is cheap stays unresolved.

What to watch

  • Whether Xandr files an appeal inside the three-week window, which on a count from the Oct. 12 announcement ends around Nov. 2.
  • Whether another EU data protection authority brings a case against a real-time bidding intermediary on the same shared-responsibility reasoning.
  • The text of the European Commission's Digital Omnibus, which noyb says could blunt the precedent.

Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence78
Adoption
Not scored
Hype gap+12
Incentives45
Confidence80

Perspective Coverage

7 publishers
Builder
Builder 18%
Operator
Operator 50%
Investor
Investor 32%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Norway's data protection authority fined Microsoft's adtech unit Xandr 92 million crowns ($9.61 million) for unlawfully relaying Grindr users' sensitive data to thousands of advertisers, it said on Monday, Oct 12.

    Reported Supported Source: Reuters-style report carried by channelnewsasia.comView cited source
  2. [2]

    It is the biggest fine the Norwegian authority has issued.

    Reported Supported Source: channelnewsasia.com; cryptopolitan.com also calls it the largest the agency has imposed on a companyView cited source
  3. [3]

    Xandr relayed data revealing the sexual orientation of users of Grindr, a dating app for LGBTQIA+ people, to companies in automated ad auctions from July 2018 to April 2020.

    Reported SupportedView cited source
  4. [4]

    Xandr said it assumed Grindr had obtained users' consent and never checked, the data protection authority said; the authority rejected that argument and ruled Xandr shared legal responsibility with Grindr.

    Reported Supported Source: Norwegian data protection authority, as reported by channelnewsasia.comView cited source
  5. [5]

    The fine was based on Xandr's revenue, not Microsoft's, which did not own the unit at the time.

    Reported SupportedView cited source
  6. [6]

    The data protection authority fined Grindr 65 million crowns over the same breaches in 2021.

    Reported SupportedView cited source
  7. [7]

    In 2025, Norway's courts upheld a 65 million kroner fine against Grindr for illegally sharing users' sensitive personal information.

    Reported SupportedView cited source
  8. [8]

    "Responsibility for data protection cannot be delegated to others," Datatilsynet Director General Line Coll said in the authority's statement.

    Reported Supported Source: Line Coll, as quoted by Tech Xplore and relayed by cryptopolitan.comView cited source
  9. [9]

    Coll said each company must independently ensure and be able to demonstrate that it has a legal basis for using the data it procures.

    Reported Supported Source: cryptopolitan.com's account of Coll's statementView cited source
  10. [10]

    Real-time bidding sells ad space in milliseconds as a user opens an app; when someone launched Grindr in Norway, their personal data was sent through Xandr and potentially shared with thousands of companies in the advertising industry, according to Datatilsynet.

    Reported Supported Source: Datatilsynet, via cryptopolitan.comView cited source
  11. [11]

    Xandr's direct financial benefit from the data sharing was another key factor in assessing the magnitude of the fine.

    Reported SupportedView cited source
  12. [12]

    Microsoft said: "This investigation and decision focused on conduct that predates Microsoft's acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing the decision and assessing our options,"

    Reported Supported Source: Microsoft statement, via channelnewsasia.comView cited source
  13. [13]

    The case began with a 2020 complaint by the Norwegian Consumer Council and the Austrian data privacy organisation noyb.

    Reported SupportedView cited source
  14. [14]

    Xandr has three weeks to appeal.

    Reported SupportedView cited source
  15. [15]

    Microsoft is valued at around $3.97 trillion, according to GuruFocus.

    Reported Supported Source: GuruFocus, via cryptopolitan.comView cited source
  16. [16]

    noyb called the decision "a valuable precedent".

    Reported Supported Source: noyb, via channelnewsasia.comView cited source
  17. [17]

    noyb warned that the precedent could lose its intended effect if the European Commission's proposed Digital Omnibus weakens how the GDPR treats the matter (the source sentence is cut off after 'treats').

    Reported Supported Source: noyb, via cryptopolitan.comView cited source
  18. [18]

    Earlier in 2026 in France, the Conseil d'Etat upheld a 40 million euro fine against retargeting company Criteo, rejecting its claim that partner websites were responsible for collecting consent.

    Reported SupportedView cited source
  19. [19]

    The $9.61 million fine is roughly 0.00024 percent of a $3.97 trillion valuation.

    Derived Supported
  20. [20]

    The fine came about 6.5 years after the conduct ended in April 2020.

    Derived Supported
  21. [21]

    Three weeks counted from the Oct 12 announcement ends around Nov 2.

    Derived Supported
  22. [22]

    The Xandr fine is about 1.4 times the Grindr fine over the same breaches.

    Derived Supported
  23. [23]

    Over roughly 21 months of conduct, 92 million crowns is about 4.4 million crowns, or about $458,000, a month.

    Derived

Sources

7 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · October 12, 2026

    Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
  2. channelnewsasia.com

    1 article · October 12, 2026

    Norway fines Microsoft's Xandr $9.6 million over Grindr data sharing
  3. cryptopolitan.com

    1 article · October 12, 2026

    Norway fines Microsoft subsidiary Xandr $9.6 million over privacy violations with Grindr
  4. engadget.com

    1 article · October 12, 2026

    Norway fined a Microsoft subsidiary $9.6 million for allegedly misusing Grindr user data
  5. malwarebytes.com

    1 article · October 13, 2026

    Grindr users’ sensitive data shared through ad auctions without valid consent
  6. scworld.com

    1 article · October 13, 2026

    Microsoft-owned Xandr fined $9.6 million for unlawful Grindr user data sharing
  7. thehackernews.com

    1 article · October 13, 2026

    Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

Topics and entities

Topics

Entities