The Norwegian Data Protection Authority (Datatilsynet) has issued a landmark administrative fine of €8.6 million (approximately $9.62 million) against Xandr, an advertising technology unit currently owned by Microsoft. The penalty, the largest ever levied by the Norwegian watchdog, stems from the unauthorized processing and relaying of sensitive personal data belonging to users of the dating application Grindr. The decision marks a significant escalation in the regulatory scrutiny surrounding the automated advertising ecosystem, specifically regarding the handling of highly intimate user information.
According to the regulatory body, the infringement occurred between July 2018 and April 2020. During this window, Xandr functioned as a critical intermediary in the programmatic advertising supply chain, facilitating the transfer of user data—including information revealing sexual orientation—to a vast network of thousands of third-party advertisers. The Norwegian authorities have categorized the breach as "very serious," citing the violation of fundamental privacy rights and the potential for severe social harm given the nature of the information exposed.
Chronology of Regulatory Action and Allegations
The roots of this legal battle trace back to 2020, when the Norwegian Consumer Council, in collaboration with the Austrian digital rights non-profit organization None of Your Business (noyb), filed a formal complaint. The plaintiffs argued that the real-time bidding (RTB) system employed by Xandr and its partners was fundamentally incompatible with the General Data Protection Regulation (GDPR).
The complaint highlighted that when a user opened the Grindr app, their personal data was broadcast to a multitude of actors within the advertising ecosystem. This process enabled advertisers to engage in automated bidding wars to display targeted advertisements, all occurring without the user’s explicit knowledge or informed consent.
- July 2018 – April 2020: The period of infringement during which Xandr acted as a data processor and joint controller for Grindr user data.
- January 2020: The Norwegian Consumer Council and noyb initiate formal legal complaints against Xandr.
- December 2021: Microsoft completes the acquisition of Xandr from AT&T, inheriting the operational history and associated legal risks of the entity.
- June 2023: Microsoft officially retires the Xandr brand, consolidating its assets under the Microsoft Advertising umbrella.
- October 2026: The Norwegian Data Protection Authority issues the final ruling and the €8.6 million fine.
Regulatory Findings on Data Stewardship
The central point of contention in the investigation was the assignment of responsibility for user consent. Datatilsynet determined that Xandr acted as a "joint controller" alongside Grindr. Under the GDPR, joint controllership carries significant legal weight; both parties are obligated to ensure that the data subject has provided valid, freely given, and informed consent before any data processing occurs.
Xandr’s defense throughout the proceedings largely rested on the assumption that Grindr, as the primary app interface, was responsible for obtaining the necessary consents. The DPA rejected this argument, noting that simply pointing fingers at an upstream partner does not absolve a company of its independent obligations to verify the legal basis for processing sensitive data. The watchdog emphasized that because Xandr facilitated the real-time bidding process, it had an active role in the data flow and therefore shared the burden of compliance.
Broader Implications for the Ad-Tech Industry
The fine serves as a stark warning to companies operating within the programmatic advertising space. The "real-time bidding" model has long been criticized by privacy advocates for its opacity and its reliance on the mass distribution of personal identifiers to an unvetted array of third parties. By holding the intermediary (Xandr) accountable, the Norwegian regulator has signaled that service providers cannot claim ignorance of the downstream flow of the data they facilitate.
Max Schrems, founder of noyb, lauded the decision as a critical step toward ending what he termed the "commercial surveillance industry." The ruling suggests a growing trend among European regulators to move away from mere warning letters and toward substantial financial penalties that reflect the global revenue of the parent corporations involved.
For Microsoft, the financial impact of the €8.6 million fine is relatively minor, but the reputational and legal precedents are more complex. As the company continues to integrate ad-tech assets into its broader portfolio, this ruling underscores the potential liabilities associated with acquiring legacy data-processing entities.
Parallel Legal Challenges in the Digital Privacy Landscape
The case against Xandr is part of a larger, global wave of litigation targeting the mishandling of sensitive user data. The intersection of dating apps and data privacy has become a focal point for regulators worldwide. Notably, just last month, Grindr reached a £26 million ($35.1 million) settlement in the United Kingdom to resolve allegations that it shared sensitive health information, including HIV status, with third-party vendors without proper authorization.
Furthermore, the telecommunications sector has faced parallel scrutiny. In the United States, a federal judge recently approved a $177 million settlement involving AT&T—the original parent company of Xandr. This settlement addressed two massive data breaches in 2024. The first involved the exposure of Social Security numbers for over 70 million current and former customers on the dark web. The second incident, which affected a significant portion of AT&T’s cellular customer base, involved the illegal downloading of call and text records from a third-party cloud platform hosted by Snowflake.
These events collectively demonstrate that the digital infrastructure supporting modern communication and advertising is under unprecedented pressure to improve data hygiene and transparency. Whether through the lens of GDPR enforcement in Europe or class-action litigation in the United States, the threshold for what constitutes "reasonable" data protection is rising.
Official Responses and Future Outlook
Microsoft, in a statement provided to Reuters, confirmed that it is currently reviewing the DPA’s decision and assessing its legal options. While the company has not yet confirmed whether it will appeal, the three-week window provided by the Norwegian authority keeps the possibility of a protracted legal battle open.
Industry analysts suggest that the fine will likely force a structural shift in how programmatic advertising companies handle sensitive categories of data. Companies may move toward more "walled garden" approaches, where data is less likely to be broadcast to a wide, heterogeneous network of bidders, or they may implement more stringent vetting processes for all partners in their supply chains.
The Norwegian DPA’s decision is unlikely to be an isolated incident. As regulatory bodies across the European Economic Area continue to coordinate their efforts through the European Data Protection Board, the standard for holding entities accountable for the entire lifecycle of a user’s data—from collection to final ad-bid relay—will likely become more rigid. For the advertising industry, the era of "passive intermediary" defenses appears to be coming to a definitive end, replaced by a mandate for proactive, end-to-end data stewardship.
As the digital economy matures, the lessons from the Xandr case will undoubtedly influence future policy, legal strategies for tech acquisitions, and the fundamental architecture of the global advertising market. The high cost of compliance, while burdensome, is increasingly being viewed as a necessary prerequisite for operating in an ecosystem where user privacy is no longer a peripheral concern but a core regulatory requirement.
