Summary
- The Norwegian authority fined Xandr NOK 92 million over processing data originating from Grindr.
- The decision addresses whether an advertising intermediary may rely on consent collected by another organisation.
- The case follows complaints lodged in 2020 and is separate from the earlier fine against Grindr.
Norway’s data protection authority has fined advertising technology company Xandr NOK 92 million, approximately €8.5 million, over its processing of personal information originating from users of Grindr. The decision, publicised on 12 October, places liability on an intermediary in the digital advertising chain rather than solely on the app through which the data was originally collected.
Xandr, now part of Microsoft Advertising, handled information connected to programmatic advertising. The case follows complaints filed in 2020 by the Norwegian Consumer Council and privacy organisation noyb, after an investigation into the movement of information from mobile applications to advertising businesses.
The authority concluded that Xandr processed Grindr data unlawfully. The material was sensitive because use of the dating app could reveal information about a person’s sexual orientation. The dispute centred on valid consent and the responsibilities of businesses receiving and using information through advertising systems. Xandr’s involvement did not cease to matter simply because another company had the original relationship with the user.
The regulator previously imposed a separate NOK 65 million fine on Grindr over the same wider practices. That earlier action addressed the app’s handling of information and the conditions under which consent had been obtained. The Xandr decision extends the chain of regulatory accountability into the wider advertising market.
Microsoft, which acquired Xandr after the period under investigation, has said it takes privacy seriously and is reviewing the decision. The misconduct relates to processing undertaken before the acquisition. The financial penalty was assessed against Xandr rather than calculated using Microsoft’s overall global turnover, according to accounts of the decision.
Consent cannot simply travel unchecked
Programmatic advertising relies on a sequence of services that can include applications, exchanges, brokers, and parties selecting advertisements. Technical identifiers and accompanying data allow a user’s activity to be associated with an advertising opportunity. Information can move through several organisations in fractions of a second, making it difficult for individuals to identify every recipient.
Under the General Data Protection Regulation, an organisation processing personal data needs a lawful basis. Sensitive categories of information are subject to additional restrictions. An intermediary may therefore have obligations of its own when deciding whether and how to use data it receives, even if the first organisation in the chain has presented a consent notice.
The decision challenges the assumption that a downstream advertising participant can rely entirely on another business to obtain valid authorisation. The authority rejected reliance on that assumption in the circumstances investigated. Its conclusion is specific to the evidence and parties in this case; it does not establish that every programmatic advertising transaction uses the same data or breaches the law.
Forbrukerrådet welcomed the finding as support for enforcement across the entire advertising supply chain. noyb characterised the decision as a significant development for data brokers, although those views are advocacy interpretations and not additional holdings of the regulator.
The enforcement decision also follows several years of investigation. Conduct investigated from years earlier has produced an enforcement outcome in 2026, demonstrating how evidence collection, technical reconstruction, legal arguments, and procedural rights can prolong privacy cases. The timing also means current policies may differ materially from those examined by the authority.
A contract with another data participant is not necessarily proof that consent satisfies the law. Advertising intermediaries can receive information several steps after the interaction in which a user was asked to agree to processing. The Norwegian finding requires attention to how a recipient checked the basis for the processing it performed, rather than assuming that responsibility belonged wholly to the original application. That distinction can affect auditing and the design of relationships with partners throughout an advertising ecosystem.
Advertising intermediaries must be able to examine what records demonstrate the lawful collection and permitted use of data received from another organisation. The Norwegian authority’s decision addressed those obligations in Xandr’s processing of Grindr information; any further challenge or appeal will determine whether the finding changes.
