Norway fines Xandr €8.6m over Grindr real-time bidding data
The Norwegian Data Protection Authority has fined Xandr Inc., now part of Microsoft, EUR 8,600,000 for processing Grindr users' data without a lawful basis. The case, dating to a 2020 complaint by the Norwegian Consumer Council, turns on real-time bidding and joint controller consent obligations under the GDPR.
- The Norwegian DPA imposed an administrative fine of EUR 8,600,000 on Xandr Inc. on 2 October 2026.
- The case stems from a 2020 complaint by the Norwegian Consumer Council concerning real-time bidding in the Grindr app.
- Xandr was found to have processed advertising IDs, IP addresses and the fact of Grindr use, which the DPA classifies as data concerning sexual orientation under Article 9(1) GDPR.
- The DPA found Xandr's reliance on Grindr's consent invalid under Articles 4(11) and 7 GDPR, and held that accountability cannot be outsourced between joint controllers.
- The DPA found the infringements of Article 6(1) and Article 9(1) GDPR to be at least negligent and of high seriousness.