On October 12, 2026, Norway's data protection authority Datatilsynet made public a decision, dated October 2, fining Xandr NOK 92 million (about $9.6 million; the regulator's press release converts it to roughly €8.6 million). Xandr is the ad exchange formerly called AppNexus, which Microsoft acquired in 2022. Datatilsynet called it the largest fine it has ever issued. It found that between July 2018 and April 2020 Xandr ran real-time ad auctions inside Grindr and received and passed on Grindr users' data, potentially to thousands of companies, without a valid legal basis.

Why It Matters

For any app built around sexuality (dating, hookup, kink, sexual health, period and fertility tracking), the important point is "joint controller." Regulators now treat the ad-tech intermediaries that touch such data as responsible for checking consent themselves, not merely as conduits. That raises the compliance bar on both sides of every ad integration. Publishers of sensitive apps will find buyers more cautious, and the exchanges that buy will demand proof of explicit consent or stay away. Expect sexual-wellness and LGBTQ+ apps in Europe to have a harder time monetising through programmatic ads, and more pressure to move to subscriptions. It also adds to Grindr's bill for the 2018–2020 era: the NOK 65M Norwegian fine, the [£26M UK settlement over shared HIV data](/stories/grindr-uk-hiv-data-settlement), and now a record fine on its former ad partner. As Grindr moves into regulated health care through its [$250M Freddie acquisition](/stories/grindr-purposemed-freddie-250m) and [in-app PrEP](/stories/grindr-in-app-prep-access), its data handling will be judged by health-data standards. This decision shows how strictly European regulators apply them. U.S. operators should note the parallel with the FTC's case against [Hims & Hers over data sharing with Meta and Snap](/stories/ftc-hims-hers-privacy-lawsuit).

The legal reasoning matters well beyond this case. Under GDPR Article 9, the fact that someone uses Grindr reveals information about their sexual orientation, which is special-category data and requires explicit consent. Datatilsynet found Xandr was a joint controller with Grindr. It assumed Grindr had obtained valid consent and did nothing to check. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," said Director General Line Coll. Her headline message, per PPC Land: "Our key message is that responsibility for data protection cannot be passed on to others." According to PPC Land's reading of the 54-page decision, the data included at least the app name, advertising ID and IP address. The infringement was found negligent rather than intentional. The fine was calculated on Xandr's own turnover rather than Microsoft's, which capped it at €20 million. The decision also notes that Xandr deleted records while under investigation.

The case took a long time. The complaint was filed on January 14, 2020 by the Norwegian Consumer Council and noyb. PPC Land reports that Datatilsynet counted its own slow handling as a mitigating factor and reduced the fine, without saying by how much. Grindr itself was fined NOK 65 million in December 2021 and lost its final challenge in October 2025. A Microsoft spokesperson told BleepingComputer the case "focused on conduct that predates Microsoft's acquisition of Xandr" and that the company is "reviewing the decision and assessing our options." Xandr has three weeks to appeal. "This sends a powerful signal to everyone whose business model depends on tracking and profiling consumers," said Finn Myrstad of the Norwegian Consumer Council.

Sources

Update — 2026-10-13

Initial entry — story first created.