Norway's Data Protection Authority (Datatilsynet) has fined Xandr, an advertising subsidiary of Microsoft, NOK 92 million (about $9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in Norway. Both BleepingComputer and Engadget report the same fine and the same basic allegation: Xandr did not obtain explicit consent for the ad-targeting use of the data, instead assuming Grindr had already secured user approval.
According to the regulator, when a user opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem, allowing advertisers to bid for targeted ads without the user's knowledge. The data authority described the misuse as "very serious" and calculated the fine based on Xandr's total annual turnover. The infringements took place between July 2018 and April 2020.
Engadget adds that the case began in 2020 with a complaint from Norway's consumer council, and that Xandr has three weeks to appeal the record penalty. It also notes that Grindr itself has previously faced fines from the same agency and a 2024 London lawsuit over alleged sharing of HIV status and test dates. The two sources agree on the core facts; Engadget provides additional context about the appeal window and Grindr's own legal troubles.