Norwegian Regulator Slaps $9.6 Million Fine on Microsoft’s Xandr Over Grindr Data Use

Norway's data protection authority has imposed a record fine of 9.6 million dollars on Xandr, a Microsoft‑owned advertising platform, accusing it of exploiting personal information from the dating app Grindr without proper user consent.

The regulator says Xandr harvested location, age and sexual‑orientation data from Grindr users and fed it into its ad‑targeting systems, allowing advertisers to reach individuals based on sensitive attributes that the app’s privacy policy did not permit to be shared.

Under the European Union's General Data Protection Regulation, which Norway enforces through its national watchdog, such processing of sensitive data requires explicit permission. The authority judged that Xandr's practices breached these rules, resulting in what it described as a “serious infringement” of privacy rights.

Xandr, formerly known as AppNexus before its acquisition by Microsoft, provides programmatic advertising services to a global roster of brands. Grindr, a platform with millions of LGBTQ+ users worldwide, has long emphasized the importance of protecting its community's privacy. The fine underscores the tension between data‑driven advertising models and the heightened expectations for confidentiality around intimate personal details.

The company has been given three weeks to lodge an appeal against the penalty, a timeframe that reflects the regulator's intent to move swiftly on high‑profile violations. Legal experts note that the case could set a precedent for how tech firms handle sensitive user data across Europe, potentially prompting tighter compliance checks and redesigns of ad‑tech ecosystems.