The Fine And What It Covers
Norway's Data Protection Authority, Datatilsynet, fined Xandr, now part of Microsoft, NOK 92 million on 12 October for processing and sharing sensitive personal data of Grindr users in breach of data protection law.
| Point | Detail |
|---|---|
| Fine | NOK 92 million, about 8.6 million euros at the authority's conversion (noyb says 8.5 million, BleepingComputer 9.6 million US dollars) |
| Rank | Highest fine Datatilsynet has issued to date |
| Period | July 2018 to April 2020, almost two years |
| Basis of the amount | Xandr's own annual turnover, not Microsoft's |
| Earlier Grindr fine | NOK 65 million in 2021 for equivalent breaches |
| Appeal window | Three weeks from receiving the decision |
Xandr took part in real-time bidding as both buyer and seller. When someone opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of advertisers who bid to show that person an advert, all of it hidden from the user. The data included information revealing sexual orientation, which the authority says is specially protected: being a Grindr user is itself information that indicates it. The Borgarting Court of Appeal ruled the same way in the case of Grindr's own NOK 65 million fine for equivalent breaches in 2021.
Why Relying On Grindr's Consent Failed
Datatilsynet concluded that explicit consent was required to process this data and that Xandr had done nothing to make sure it had valid consent. Xandr's defence was that it believed Grindr had collected users' consent, and the authority does not accept that companies can simply blame each other.
The authority found that Xandr was a joint controller with Grindr, so the duty to have a legal basis was Xandr's own. Director General Line Coll put the principle plainly: responsibility for data protection cannot be passed on, and every company must itself ensure, and be able to document, that it processes personal data lawfully.
Information about sex life or sexual orientation sits in the special categories of GDPR Article 9, where processing is prohibited unless an exception applies. Two factors raised the fine: the practice lasted almost two years, and Xandr drew a direct financial benefit from the unlawful sharing.
What Microsoft Says And What noyb Adds
Microsoft told BleepingComputer that the investigation and outcome focused on conduct that predates its acquisition of Xandr, that legal frameworks and their enforcement have changed since, and that it is reviewing the decision and assessing its options. Xandr now operates as Microsoft Advertising.
The authority calculated the amount on Xandr's own total annual turnover and did not use Microsoft's, because Xandr was not part of Microsoft in the period in question. Even so, the fine now sits with a Microsoft-owned business, a reminder that a data history travels with the company that is bought.
noyb, which filed the original complaint together with the Norwegian Consumer Council in 2020, calls the decision a major blow for online advertising. It also argues that the European Commission's Digital Omnibus proposal, now under discussion in Parliament and Council, would take online tracking IDs out of the GDPR's scope after heavy big tech lobbying. That is noyb's reading of the proposal, not a Commission statement.
A Verification Habit For Anyone Who Receives Data
The practical lesson is that a partner's statement that consent exists is a claim to verify, and the verification belongs to you.
The ruling concerns advertising technology, but its reasoning fits any company that receives personal data through an ad platform, an SDK, a lead partner or a purchased list. The table is Servola's suggestion for applying the principle, not wording from the ruling.
| Where you receive personal data | What to verify | Evidence to keep |
|---|---|---|
| Ad platform or SDK feed | What consent the sender collected and whether its wording covers your use | The consent text and the platform's written confirmation |
| Lead or list partner | Whether each person agreed to be contacted by you | A sample of consent records and the contract clause on legal basis |
| Tags and pixels on your own site | What each vendor does with visitor data and whether your banner covers it | The vendor list and the consent log with dates |
Treat any feed that could reveal health, beliefs or sexual orientation as Article 9 data and verify before the first record is used. A single unverified source can turn everything downstream into a breach.
Read next: Google Was Fined for Proof It Could Not Produce | Twitch Trains Amazon AI on Your Streams by Default
