Norwegian Data Watchdog Hits Microsoft’s Xandr with $9.6 Million Penalty Over Grindr Data Misuse

The Norwegian data protection agency has levied a historic $9.6 million sanction on Xandr, the advertising unit owned by Microsoft, alleging that it misused personal data from the dating service Grindr without obtaining users’ consent.

According to the regulator, Xandr extracted users’ location, age and sexual‑orientation details from Grindr and injected them into its advertising‑targeting platform, enabling marketers to target people on the basis of sensitive traits that Grindr’s privacy policy expressly forbids sharing.

The EU’s General Data Protection Regulation—implemented in Norway by the national authority—mandates explicit consent for handling such sensitive information. The watchdog concluded that Xandr’s actions violated these provisions, labeling the conduct a "serious infringement" of privacy rights.

Previously operating as AppNexus before Microsoft’s purchase, Xandr delivers programmatic ad services to a worldwide client base. Grindr, which serves millions of LGBTQ+ users around the globe, has consistently stressed the need to safeguard its community’s privacy. The penalty highlights the clash between data‑centric advertising practices and growing demands for confidentiality of intimate personal information.

Xandr has three weeks to file an appeal of the fine, a deadline that signals the regulator’s desire for rapid resolution of high‑profile breaches. Legal commentators observe that the ruling may establish a benchmark for the treatment of sensitive user data by technology companies throughout Europe, possibly spurring stricter compliance audits and overhauls of ad‑tech infrastructures.