Norway fines Microsoft-owned Xandr NOK 92 million over Grindr users' data
On October 12, 2026 Norway's Data Protection Authority, Datatilsynet, fined the Microsoft-owned ad tech company Xandr NOK 92 million, roughly EUR 8.6 million. It is the largest fine the authority has ever issued, and it rests on Grindr users' data, including data revealing sexual orientation, being passed to advertisers through real-time bidding.
"The app collected consent" did not work as a defence
According to Datatilsynet's announcement dated October 12, 2026, Xandr, which was called AppNexus at the time, processed and shared personal data of Grindr users in Norway without a legal basis between July 2018 and April 2020. That data included information revealing sexual orientation. The authority points out that simply being a Grindr user already signals this, and that such information is specially protected. The fine is NOK 92 million: Datatilsynet gives the euro equivalent as about EUR 8.6 million, while BleepingComputer reports it as 9.6 million dollars.
The regulator's finding is straightforward. Processing this data required explicit consent, yet Xandr took no steps to make sure valid consent existed and never checked whether the consents coming from Grindr held up. Xandr argued that it believed Grindr had obtained consent. Datatilsynet rejected that argument and treated Xandr as a joint controller together with Grindr. Director General Line Coll summed up the core message: "responsibility for data protection cannot be passed on to others".
Opening the app could send data to thousands of ad players
The case centres on real-time bidding. Datatilsynet says Xandr sat on both the buy side and the sell side of these auctions. When someone opened Grindr, their data was in many cases routed through Xandr and could reach potentially thousands of companies in the ad ecosystem, where advertisers competed with bids for the chance to show a targeted ad, all out of the user's sight. The complaint dates back to 2020: Datatilsynet names the Norwegian Consumer Council (Forbrukerrådet) as the complainant, while BleepingComputer reports that the Austrian privacy group noyb filed it in January 2020 together with the council.
Several factors shaped the amount. The authority weighed heavily the fact that Xandr gained a direct financial benefit from the unlawful sharing, and it treated the nearly two-year duration as an aggravating factor. The fine was calculated on Xandr's own total annual turnover rather than Microsoft's, because Xandr was not yet part of Microsoft during the period in question. Xandr has three weeks from receiving the decision to appeal. BleepingComputer notes that the company now operates as Microsoft Advertising.
Every link in the ad chain owns its own consent check
The decision targets a common assumption in programmatic advertising: if the app or publisher gathered consent, everyone downstream can process the data without asking questions. In Datatilsynet's view, every company must make sure its own handling of personal data is lawful and keep the paperwork to prove it. Coll warned that when companies shift blame onto one another, users' rights become worthless in practice, and said the case shows how opaque the ad ecosystem is for individuals. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data", she said. There is precedent too: Grindr was fined NOK 65 million in 2021 for equivalent breaches, and the Borgarting Court of Appeal ruled that such data enjoys special protection.
Reactions came from both sides. noyb, according to BleepingComputer, called the decision "a major blow to the online adtech industry". A Microsoft spokesperson said the investigation focused on conduct from before Microsoft acquired Xandr, added that legal frameworks and how they are interpreted have changed since then, and said Microsoft is reviewing the decision and assessing its options. An appeal is available, but whether Microsoft will pursue one is not yet known.
The sources say nothing about Türkiye, so this section is commentary
Neither source mentions Türkiye. The decision concerns Grindr users in Norway and the 2018 to 2020 period; there is no information about users in Türkiye, Turkish advertisers or any Turkish regulator. What follows is therefore not drawn from the sources but is clearly UNALSOFT's own view.
Our view: brands and agencies working under Türkiye's data protection law, KVKK, also pass data on through pixels and tags on their sites and through third-party ad partners. The logic of the Norwegian decision is that assuming someone else collected consent is no defence, which turns keeping your own consent records into a risk management issue. We saw a similar pattern locally in the KVKK breach notices of September 16, where breaches happened at a vendor while responsibility stayed with the brand; that piece is unrelated to this case. The open questions, one by one: whether users in Türkiye were affected by similar data flows, whether any Turkish authority will respond to the decision, whether Microsoft will appeal, and whether the decision will have any bearing on Microsoft Advertising's current practices.
UNALSOFT's take
We read this less as an ad tech story and more as a chain of responsibility story. In any campaign, data moves between the website, the tag manager, the ad platform and intermediary technology vendors, and Datatilsynet expects every one of those links to verify consent itself. The practical takeaway is simple: list which tag sends which data to whom, make sure consent settings match the user's actual choice, and keep signals that could fall into sensitive categories out of targeting altogether. That inventory is why our ad management work starts there before any campaign goes live. Because the sources contain no data on Türkiye, this piece does not suggest any local legal outcome.
Do you know which data your ad tags send, and to whom?
A short call is enough to review together whether the pixels and tags on your site match your users' consent.