Background information

• Date of final decision: 2 October 2026
• National case 
• Controller: Xandr Inc.
• Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)
• Decision: Administrative fine
• Key words: Fines, Basic principles, Marketing, Online platforms

Summary of the Decision

Origin of the case  

The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people.

Key Findings 

The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR and data concerning sexual orientation under Article 9(1) GDPR. Xandr is considered a joint controller for the processing, both as supply-side and demand-side platform. Since the data were special category personal data, explicit consent under Article 9(2)(a) was the relevant legal basis for the processing. Xandr did not obtain consent itself, but relied on Grindr’s consent, which were invalid under Articles 4(11) and 7 GDPR. The DPA holds that accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing. The infringements were at least negligent. In light of the fact that the infringements concern some of the most central provisions in the GDPR, including sensitive data, the Norwegian DPA regards the infringements of high seriousness.

Decision

The Norwegian DPA imposed an administrative fine of EUR 8 600 000 on Xandr Inc. for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR.

For further information: 

• Norwegian Press Release: Datatilsynet gir Microsoft-selskap 92 millioner i gebyr | Datatilsynet
• English Press Release: Microsoft company fined NOK 92 million | Datatilsynet