News Date: 2026-10-12
Norway's Data Protection Authority has imposed its largest fine to date on Xandr, the advertising technology company now owned by Microsoft. The NOK 92 million penalty, worth approximately $9.6 million, concerns the handling of sensitive information associated with Grindr users between July 2018 and April 2020.
Consent Assumptions Created Regulatory Exposure
Xandr acted as an intermediary for real-time advertising auctions inside Grindr. In this model, participating companies received profiling information before bidding for the opportunity to display an advertisement. Norwegian regulators concluded that this process potentially disclosed information capable of revealing users' sexual orientation to thousands of advertising businesses.
The authority determined that Xandr and Grindr were joint controllers of the relevant data. Xandr reportedly assumed that Grindr had collected valid consent but did not independently confirm that the consent met legal requirements. That failure became central to the enforcement action because sensitive personal information generally demands a stronger and more explicit legal basis than ordinary advertising data.
Microsoft said the investigated conduct occurred before its acquisition of Xandr and noted that privacy law and enforcement practices have evolved. The company is reviewing the decision and has three weeks to appeal.
What Technology Leaders Should Learn
This case demonstrates that businesses cannot safely outsource responsibility for consent. An organization receiving, enriching, auctioning or redistributing personal data must understand where that information originated, what users were told and whether the documented permission covers every downstream purpose.
- Map personal information across advertising and analytics partners.
- Require verifiable consent records rather than contractual assurances.
- Apply additional controls to health, sexuality, location and identity data.
- Review inherited data practices after mergers and acquisitions.
In my view, the most important lesson is that privacy due diligence must become as rigorous as technical security testing. Acquiring a platform can also mean acquiring years of regulatory exposure. Companies should therefore examine historical data flows, consent mechanisms and partner relationships before integrating an acquired service into a larger technology brand.
The decision also challenges the advertising industry's reliance on rapid, opaque data exchanges. If participants cannot clearly prove why they are entitled to receive sensitive information, the commercial value of that data may be outweighed by legal, reputational and operational risk.