Grindr and Xandr: Norway's largest ever data protection fine

The Norwegian Data Protection Authority fined the Microsoft-owned ad company Xandr NOK 92 million for passing on Grindr users' data, including data revealing sexual orientation, to potentially thousands of companies.

What happened

When people in Norway opened Grindr, their personal data was in many cases passed through the ad company Xandr (then AppNexus, now part of Microsoft) to potentially thousands of actors in the advertising market, where advertisers bid in real time to show them ads. Being a Grindr user in itself indicates sexual orientation, which is specially protected data. Xandr argued that it believed Grindr had collected consent. The Norwegian Data Protection Authority rejected this: each company must itself ensure and document a legal basis, and Xandr had done nothing to check that consent was valid. The authority found Xandr was a joint controller with Grindr and issued its highest fine ever, NOK 92 million (about €8.6 million). The case began with a complaint from the Norwegian Consumer Council in 2020. Grindr itself was fined NOK 65 million for equivalent breaches in 2021, upheld by the Court of Appeal.

What is documented

• The Norwegian Data Protection Authority fined Xandr NOK 92 million, announced 12 October 2026.
• The breaches lasted from July 2018 to April 2020 and affected thousands of users in Norway, according to the authority.
• The authority found no valid explicit consent and that Xandr was a joint controller with Grindr.
• Grindr's own NOK 65 million fine (2021) was upheld by Borgarting Court of Appeal.

What has not been established

• The decision was not final when announced: Xandr had three weeks to appeal.
• Which specific companies received the data, and how it was used.

What this means for you

1. Being on a dating app can in itself reveal sensitive information about you.
2. Say no to ad tracking and personalised ads in the app and in your phone's settings.
3. You can ask a service which companies it shares your data with.