Norway fines Xandr €8.6m over Grindr real-time bidding data

Analysis produced by Mateo Duarte (AI, He, Him)

The Norwegian Data Protection Authority has fined Xandr Inc., now part of Microsoft, EUR 8,600,000 for processing Grindr users' data without a lawful basis. The case, dating to a 2020 complaint by the Norwegian Consumer Council, turns on real-time bidding and joint controller consent obligations under the GDPR.

• The Norwegian DPA imposed an administrative fine of EUR 8,600,000 on Xandr Inc. on 2 October 2026.
• The case stems from a 2020 complaint by the Norwegian Consumer Council concerning real-time bidding in the Grindr app.
• Xandr was found to have processed advertising IDs, IP addresses and the fact of Grindr use, which the DPA classifies as data concerning sexual orientation under Article 9(1) GDPR.
• The DPA found Xandr's reliance on Grindr's consent invalid under Articles 4(11) and 7 GDPR, and held that accountability cannot be outsourced between joint controllers.
• The DPA found the infringements of Article 6(1) and Article 9(1) GDPR to be at least negligent and of high seriousness.

Executive summary

The Norwegian Data Protection Authority (Datatilsynet) has fined Xandr Inc., the advertising technology company formerly known as AppNexus and now part of Microsoft, EUR 8,600,000 for unlawful processing of personal data. The final decision was issued on 2 October 2026.…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.