CONFIRMED: Norway’s Data Protection Authority (Datatilsynet) announced the fine on 12 October 2026. Microsoft’s response is REPORTED by BleepingComputer.
Norway’s Data Protection Authority has issued “an administrative fine of 92 million Norwegian kroner, equivalent to €8.6 million, which is the highest fine it has issued to date” to Xandr, an advertising technology company now part of Microsoft [1].
The authority says Xandr “relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies” [1]. Grindr is a location-based dating app aimed at gay, bi, trans and queer people [1].
How the data was shared
The data moved through real-time bidding.
In plain words: when someone opens an app with advertising space, details about that person are sent out to advertising companies, which bid against each other in an automatic auction, in a fraction of a second, for the right to show them an ad. The person does not see any of this.
The regulator says that when a person opened Grindr, “their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem” [1].
Why Xandr was fined
- Datatilsynet found Xandr was a joint controller with Grindr, meaning it shared legal responsibility for the data [1].
- Explicit consent was required, but Xandr “had not done anything to ensure that they had valid consent” and assumed this was Grindr’s responsibility [1].
- The breaches ran “from July 2018 to April 2020” [1].
- The fine was calculated on Xandr’s own annual turnover. “Microsoft’s turnover was not used, as Xandr was not a part of Microsoft for the time period in question” [1].
Line Coll, Director General of the authority, said: “Our key message is that responsibility for data protection cannot be passed on to others. Each and every company must itself ensure, and be able to document, that they process personal data lawfully” [1].
The case began with a 2020 complaint from the Norwegian Consumer Council. Grindr itself was fined 65 million kroner for equivalent breaches in 2021 [1].
What happens next
Xandr has three weeks from receiving the decision to appeal [1].
A Microsoft spokesperson told BleepingComputer that the case “focused on conduct that predates Microsoft’s acquisition of Xandr”, and that Microsoft is “reviewing the decision and assessing our options” [2].
Sources
- Datatilsynet (Norwegian Data Protection Authority), “Microsoft company fined NOK 92 million”, 12 October 2026. https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/
- BleepingComputer (Bill Toulas), article on the Xandr fine (headline contains its own USD conversion, not used), 12 October 2026. https://www.bleepingcomputer.com/news/security/norway-fines-microsoft-ad-firm-96-million-over-grindr-data-sharing/
, its highest fine yet, for sharing Grindr users' sensitive data in ad auctions.){kind=link}