Norwegian DPA fines Microsoft-owned Xandr EUR 8.6 million over Grindr data
The Norwegian Data Protection Authority has fined advertising technology company Xandr Inc. EUR 8 600 000 for processing personal data of Grindr users in Norway without a legal basis. According to the EDPB, the authority also found that Xandr handled data concerning sexual orientation without a valid exemption under the GDPR.
- The Norwegian DPA fined Xandr Inc. EUR 8 600 000 over processing of Grindr users' data in Norway.
- The case began in 2020 with a complaint from the Norwegian Consumer Council; Xandr was then AppNexus and is now part of Microsoft.
- The authority found violations of Article 6(1) and Article 9(1) GDPR, with invalid consent relied on from Grindr.
- The DPA says accountability cannot be outsourced and each joint controller must verify consent itself.
- The final decision is dated 2 October 2026.
How the case began
The case dates back to 2020, when the Norwegian Consumer Council lodged a complaint with the Norwegian DPA against Xandr. At the time the company was called AppNexus; it is now part of Microsoft.
The complaint concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people. The final decision was dated 2 October 2026, and the EDPB published a summary of it on 16 October 2026.
What the authority found
The Norwegian DPA found it proven by clear preponderance of probability that Xandr processed Grindr users' personal data during real-time bidding. This covered at least the fact that individuals were using Grindr, their advertising ID and their IP addresses. The authority classed these as personal data under Article 4(1) GDPR and as data concerning sexual orientation under Article 9(1) GDPR.
Xandr was considered a joint controller for the processing, both as a supply-side and a demand-side platform. Because the data fell into special categories, explicit consent under Article 9(2)(a) was the relevant legal basis.
Xandr did not obtain consent itself. It relied on the consent collected by Grindr, which the authority found invalid under Articles 4(11) and 7 GDPR. The DPA holds that accountability cannot be outsourced, and that each joint controller must independently verify that consent is valid and covers its own processing.
The fine and its basis
The authority imposed an administrative fine of EUR 8 600 000 on Xandr Inc. It found two violations:
- processing personal data of Grindr users in Norway without a legal basis, in breach of Article 6(1) GDPR;
- processing special category personal data concerning sexual orientation without a valid exemption, in breach of Article 9(1) GDPR.
The DPA concluded that the infringements were at least negligent. Because they concern some of the most central provisions in the GDPR, including sensitive data, it regards them as being of high seriousness. The Norwegian authority's own press release gives the fine as NOK 92 million.
What it means for the ad tech sector
The decision stresses that companies in the real-time bidding chain cannot simply rely on consent gathered by an app or publisher. According to the DPA, each joint controller has to check for itself that the consent is valid and covers its own processing. For advertising platforms handling sensitive categories of data, the finding sets out a clear expectation of independent verification.
