Norway fined Microsoft's Xandr a record €8.6M for relaying Grindr data

The Norwegian Data Protection Authority fined Xandr - the ad-tech unit built by AT&T out of AppNexus and later owned by Microsoft - €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The infringements ran from July 2018 to April 2020, and the DPA called the breach 'very serious' enough to merit the largest administrative fine it has ever issued, calculated on Xandr's total annual turnover during that two-year window, which predates Microsoft's acquisition. Xandr has three weeks to appeal; Microsoft said it is reviewing the decision.

The mechanism was real-time bidding. When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors, with advertisers bidding to show targeted ads - hidden from the user. The data included signals revealing sexual orientation, special-category information under European privacy law. The DPA found Xandr was a joint controller with Grindr, making it responsible for obtaining users' consent; instead of ensuring it had a legal basis for its own processing, Xandr pointed at Grindr, saying it assumed the dating app had collected consent.

The case began with a 2020 complaint by Norway's consumer council together with the Austrian privacy non-profit noyb, alleging Xandr unlawfully shared Norwegian users' personal data without explicit consent. Xandr's corporate life has since dissolved - AT&T formed it after acquiring AppNexus in June 2018, sold it to Microsoft in late December 2021, and the brand was folded into Microsoft Ads in June 2023 - but the liability attached to the entity that did the processing. The decision lands a month after Grindr paid £26 million to settle a UK suit over sharing users' data, including HIV status.

€8.6 million ($9.62 million), the Norwegian DPA's largest-ever fine, sized on Xandr's turnover for 2018-2020; three weeks to appeal.

As a joint controller, Xandr needed its own legal basis for processing and could not simply assume Grindr had obtained users' consent.

Real-time bidding relayed each Grindr app-open to potentially thousands of bidders - invisible to the user and uncontrollable once sent.

The data revealed sexual orientation, special-category information under GDPR, which is why the DPA set a record fine rather than a routine one.

The fine was sized on Xandr's turnover during the infringement window, before Microsoft's ownership, so the penalty followed the conduct, not the current owner.

Being an intermediary is not a shield: whoever qualifies as a joint controller owns the consent question, even for data someone else collected.

Xandr has three weeks to appeal the decision, and Microsoft says it is reviewing it and assessing its options. Noyb called the fine a 'major blow for the online advertising and commercial surveillance industry'. The decision completes a circle that began when Grindr's own data practices drew Norway's biggest privacy fine in 2021: the ad-tech intermediary that bought and resold the access has now been fined too.