Norway’s data protection authority has fined Xandr Inc. NOK 92 million for unlawfully processing personal data about Grindr users in Norway. Its decision, dated 2 October 2026, concerns advertising transactions between July 2018 and April 2020. The regulator found that Xandr lacked both a lawful basis for processing and a valid exception allowing it to process data concerning sexual orientation.
The Xandr decision examines the company’s own responsibilities in the advertising chain. Xandr relied on consent collected by Grindr, but the authority found that consent invalid and rejected the idea that Xandr could leave verification entirely to its partner.
How Grindr user data entered advertising auctions
The case followed a complaint from the Norwegian Consumer Council in January 2020. Xandr, previously AppNexus and now owned by Microsoft, participated in real-time bidding: automated auctions through which advertisers compete to show an advert to someone using an app or website.
The authority found that Xandr processed at least the fact that a person used Grindr, together with their advertising identifier and IP address. It examined Xandr’s role on both the supply side, helping make advertising space available, and the demand side, helping advertisers buy it. The DPA account describes data being relayed through Xandr to potentially thousands of advertising businesses. That is a description of potential distribution, rather than a verified recipient count for every user.
The investigation covered 20 July 2018 to 7 April 2020. It did not establish that the same processing continues today. Nor is the Xandr penalty a new fine against Grindr: the decision addresses Xandr’s conduct in a separate proceeding.
Why consent and joint controllership mattered
The regulator treated data linking an identifiable person to Grindr use as data concerning sexual orientation. An advertising identifier does not remove that sensitivity when it is combined with the app’s identity. The finding concerned what the combined information revealed, without requiring an explicit field stating a person’s sexual orientation.
The authority found Xandr to be a joint controller with Grindr for the processing it examined, on both sides of the bidding process. In sections 6.6–6.9 of the full decision, it explains why Xandr’s role brought its own responsibility to check the basis for processing. Allocating the task of collecting consent to another controller did not remove that responsibility.
For this processing, the authority found that explicit consent was the relevant exception under Article 9. Xandr had not obtained consent itself and relied on Grindr’s invalid consent. The resulting infringements were processing without a lawful basis under Article 6(1) and processing special category data without a valid exception to Article 9(1).
The penalty and the right to appeal
The imposed penalty is NOK 92 million. The authority weighed the seriousness and duration of the infringements and Xandr’s financial benefit from the processing. It also treated lengthy case handling as a mitigating factor. It used Xandr’s revenue rather than Microsoft’s turnover, explaining that Microsoft did not own Xandr during the period under investigation.
The EDPB summary, published on 16 October 2026, identifies 2 October as the decision date. Section 8 of the decision gives Xandr three weeks from receipt to appeal to the Norwegian authority; if it upholds the decision, the case goes to the Norwegian Privacy Appeals Board. These sources do not establish whether an appeal has since been filed or the fine paid.
A practical check for marketing and compliance teams
Measured Collective’s takeaway is to ask for evidence behind a partner’s consent assurance. For an advertising data flow, record which information leaves the app or website, which organisations receive it, and what their actual roles are. Where a partner collects consent, request the wording and records that demonstrate it covers the processing your organisation performs. Escalate any uncertainty about information that reveals sensitive characteristics before approving that use.
Keep the case boundary clear when briefing colleagues: this is a Norwegian decision about the specified historical processing. For related cases, browse our European enforcement coverage. For this case’s findings and appeal provisions, retain the official decision in the supplier-review record.
