Datatilsynet fined Xandr 92 million Norwegian kroner (about $9.6 million) for unlawfully processing and sharing sensitive Grindr user data between Jul. 2018 and Apr. 2020.
Xandr shared personal data of Grindr users in Norway and elsewhere with thousands of advertisers without the users’ awareness or explicit consent. Xandr believed Grindr had secured proper consent, yet it did not confirm this or establish its own legal basis for processing.
During the relevant period, Xandr functioned as a joint controller alongside Grindr, which required it to secure explicit consent for the data use. Xandr has three weeks from receiving the decision to file an appeal.
This fine is the largest ever issued by the Norwegian Data Protection Authority. The fine was calculated based on Xandr’s own annual turnover; Microsoft’s revenue was not used because Xandr was not yet part of Microsoft during the infringement period.
The Norwegian Consumer Council and the privacy organization NOYB filed the original complaints in Jan. 2020 that led to the investigation. The Norwegian Data Protection Authority said that companies cannot outsource protecting personal data and that each company must verify and document its own lawful processing.
In December 2021, Grindr was fined 65 million Norwegian kroner (roughly $7.2 million) for comparable breaches, a penalty later affirmed by Norway’s Court of Appeal in October 2025. Line Coll, Director General of Datatilsynet, said, “We issued such a high fine in this case because the breaches we identified were very serious.”
Join the discussion