Norway: NOK 92 million data protection fine against Xandr is final

Datatilsynet, the Norwegian Data Protection Authority, announced an administrative fine of NOK 92 million, equivalent to EUR 8.6 million, against Xandr in its announcement “Microsoft company fined NOK 92 million”. An update dated 3 November 2026 states that the company did not appeal and the decision is final. The fine concerns the unlawful processing and sharing of personal data belonging to Grindr users in Norway, including information revealing sexual orientation.

According to Datatilsynet, Xandr operated on both the buying and selling sides of real-time advertising auctions: when users opened the app, their data was in many cases relayed through its service to potentially thousands of operators. The findings identify Xandr as a joint controller with Grindr. Explicit consent was required to process these data, but Xandr had not checked its validity, considering collection to be Grindr’s responsibility, or ensured a legal basis for its own processing.

The infringements lasted from July 2018 to April 2020. Their duration and the direct financial benefit from unlawful sharing influenced the fine, which was calculated using Xandr’s turnover. Microsoft’s turnover was excluded because Xandr did not belong to the group during the relevant period. These details and the decision’s final status are reported in Datatilsynet’s announcement; they have not been checked against the full text of the decision.