Norway fines Microsoft's Xandr €8.6 million over Grindr data pipe
The ad-tech unit kept relaying sensitive user data for months after Grindr itself was penalised. The regulator says that is on the receiver, not just the sender.
Key points
- Norway's Data Protection Authority fined Xandr, the advertising arm Microsoft bought in 2022, €8.6 million (about $9.62 million), the largest penalty the watchdog has ever issued.
- The case covers data relayed from the dating app Grindr between July 2018 and April 2020, including signals that let advertisers infer users were gay or bisexual.
- Grindr itself was previously fined by the same regulator for sharing the data in the first place.
- Xandr argued it was only a technical pipe and not responsible for what Grindr sent it. The regulator rejected that.
- Microsoft folded Xandr into its wider advertising business in 2022 and has since struck exclusive ad deals with Netflix and Roku.
Norway's privacy regulator has hit Xandr, the ad-tech business inside Microsoft Advertising, with a fine of €8.6 million (around $9.62 million) for passing on sensitive personal data from users of the dating app Grindr. It's the largest fine the Norwegian Data Protection Authority has ever issued, and the regulator called the breach "very serious."
The short version: Grindr was sending user data to advertising partners in a way that effectively revealed sexual orientation, and Xandr, then called AppNexus, was on the receiving end. Grindr was fined for sending it. Now the receiver has been fined too. We reported on Grindr's £26 million U.K. Privacy settlement in September, a separate case involving health data sharing with advertisers.
What actually got shared?
Advertisers received a stream of data about Grindr users between July 2018 and April 2020. On paper it was standard ad-targeting information: device identifier, IP address (the number that identifies a device on a network), app name, rough location. The problem is the app name. If the app is Grindr, marketed to gay and bisexual users, then the fact that a person uses it is itself sensitive information about their sexuality. Under European privacy law, that category of data requires explicit, informed consent before anyone can process it. Tapping "accept" on a generic cookie banner doesn't count.
Why is Xandr the one paying?
Because the regulator decided an ad exchange isn't a neutral pipe. Xandr argued it simply received whatever Grindr chose to send and couldn't be held responsible for the content. The Data Protection Authority disagreed, treating Xandr as a data controller in its own right with its own duty to verify it had a legal basis before processing the information.
That's the piece worth watching. Every real-time bidding system in digital advertising works the same way: hundreds of partners get fed user signals in milliseconds, and each one shrugs and points at the next company in the chain. Norway has now said the shrug doesn't work.
Where does this sit in Microsoft's ad business?
Microsoft bought Xandr from AT&T in 2022 and has since pulled it into a rebranded Microsoft Advertising stack alongside the retail-ads company PromoteIQ and exclusive deals to sell ads on Netflix and Roku. Conduct the fine covers predates the Microsoft takeover, but the bill lands on Microsoft's desk now. It's an awkward footnote given the company's simultaneous push on user-privacy tooling, including the age-awareness APIs in Windows 11 we covered last month.
What should Grindr users do?
The data in question was shared between 2018 and 2020, so there's nothing to patch today. If you used Grindr in that window, your device identifier and location may have ended up in advertising databases held by companies you've never heard of. Resetting the advertising ID on your phone (in iOS Settings or Android's Privacy settings) breaks the link between your current device and those older profiles. It won't delete the historical data, but it stops older records from being matched to your current activity.
The real signal here isn't the fine amount. It's that the ad-tech middleware layer has lost its plausible-deniability defence, and every engineering team piping user signals into an exchange should be treating that as a liability question, not a compliance checkbox.
