Norwegian Data Watchdog Hits Microsoft’s Xandr with $9.6 Million Penalty for Grindr Data Misuse

The Norwegian data protection agency has levied a historic $9.6 million penalty on Xandr, the Microsoft‑owned ad platform, alleging it misused personal data from the Grindr dating app without obtaining users’ consent.

According to the regulator, Xandr collected users’ location, age and sexual‑orientation details from Grindr and injected them into its advertising‑targeting engine, enabling marketers to target people based on sensitive traits that Grindr’s privacy policy forbids sharing.

The European Union’s General Data Protection Regulation—implemented in Norway by the national authority—demands explicit consent for handling such sensitive information. The watchdog concluded that Xandr’s actions violated these provisions, labeling the breach a “serious infringement” of privacy rights.

Formerly called AppNexus before Microsoft bought it, Xandr supplies programmatic advertising to a worldwide client base. Grindr, serving millions of LGBTQ+ users globally, has consistently stressed the need to safeguard its community’s privacy. The sanction highlights the clash between data‑centric ad models and growing demands for confidentiality of intimate personal information.

Xandr has three weeks to file an appeal, a deadline that signals the regulator’s desire for rapid resolution of high‑profile breaches. Legal analysts warn the ruling may become a benchmark for European handling of sensitive user data, possibly spurring stricter compliance audits and overhauls of ad‑tech infrastructures.