What happened
The infringements ran from July 2018 to April 2020, when the company still operated independently of Microsoft. The regulator found that Xandr relayed data that could reveal Grindr users' sexual orientation into real-time ad auctions. In those auctions, advertisers bid for the chance to show an ad to a particular user. They bid after receiving profiling information from Xandr, which sat in the middle as intermediary.
The regulator says thousands of Norwegian users of the app were affected, because information that could reveal their sexual orientation went to advertisers without their explicit consent. The "thousands" figure is the regulator's own wording. A detailed decision summary on the DPO database says the authority could not establish the exact number of people affected, and it gave that number no weight when setting the fine.
The currency conversions don't agree, so NOK 92 million is the safest figure. Datatilsynet says it equals €8.6 million, while noyb uses €8.5 million. Reuters, via MarketScreener, converted it to $9.61 million.
The legal core: you can't outsource consent
Xandr's defence was simple. It assumed Grindr had collected valid consent and never checked. The regulator rejected that, and its Director General, Line Coll, put the point sharply. "Responsibility for data protection cannot be delegated to others. Each company must itself ensure, and be able to prove, that it is authorized to use this data."
The detailed decision summary shows how the authority reached that point:
- Joint controller status. Xandr acted as both a demand-side and a supply-side platform. The authority rejected its claim to be a mere processor on the supply side. It reasoned that Xandr designed the infrastructure and defaults, enriched ad requests in its own interest, and used customer data to improve its platform and train algorithms.
- Sensitive data. The authority treated the mere use of Grindr as revealing sexual orientation, which makes it special-category data under GDPR Article 9. The decision's findings cite Articles 6(1) and 9(1).
- Consent as the only route. Xandr never asked for consent itself. The authority held that consent was the only usable legal basis for this data, and that Grindr's consent was invalid.
- Scope limits. The case covered lawfulness under Articles 6 and 9 only. The decision's jurisdiction is limited to users in Norway.
The summary also says Xandr deleted documentation after it knew of the investigation. The authority held that this could not be used in Xandr's favour.
Why the fine isn't based on Microsoft's revenue
This detail matters most for Microsoft readers. Reuters reports the fine was based on Xandr's revenue, not Microsoft's, because Microsoft didn't own the unit at the time. The DPO summary adds the reasoning. GDPR fines normally use the turnover of the whole corporate group, but the regulator reasoned by analogy with an EU case (YKK) that Microsoft had no decisive influence during the infringement. Four percent of Xandr's own turnover came to less than €20 million, so the €20 million fixed cap applied as the ceiling. The authority then set the fine at NOK 92 million, which it placed within the EDPB range for high-gravity infringements.
Mitigating factors were limited. The summary lists a voluntary meeting in February 2025 and the very long duration of the proceedings. The complaint reached the authority on January 14, 2020, and the decision is dated October 2, 2026, which is 2,453 days later. The decision was dated October 2 but announced on October 12.
Microsoft's position
Microsoft told BleepingComputer the investigation and decision "focused on conduct that predates Microsoft's acquisition of Xandr." It added that legal frameworks and their interpretation and enforcement have changed since. The company said it is "reviewing the decision and assessing our options." Xandr has three weeks from receipt of the decision to appeal. The available reporting doesn't say whether it has.
Nothing in the evidence suggests Microsoft itself performed or directed the historical processing. Still, Xandr is Microsoft's business today, and the ruling's reasoning applies to any intermediary that handles bid-request data.
Related context
This is not the first penalty in the saga. Grindr received a 65 million kroner fine in December 2021 for sharing users' data. The Norwegian Consumer Council says an appeals court upheld that decision in 2025. The new ruling targets an intermediary in the bidding chain. The complaints came from the Consumer Council working with noyb. The Council's complaints named Grindr and five advertising companies, including Xandr, which it identifies as AppNexus/Xandr Inc.
Noyb called the outcome "a valuable precedent" (per Reuters). The Consumer Council's director, Mette Fossum, argued that if every party receiving data is responsible for valid consent, it is hard to see how today's surveillance-based advertising system can be lawful. That is advocacy, not the regulator's finding. The ruling doesn't declare all real-time bidding unlawful. It found this processing unlawful because it involved sensitive data and consent the authority judged invalid.
What IT and privacy teams should take from it
This is a regulatory outcome, not a patch, so there is no direct action for Windows admins. Still, anyone who runs or buys ad-tech, analytics or data-sharing integrations can draw practical lessons from the reasoning:
- Verify upstream consent. Don't rely on a partner's contract clause. The authority held that every joint controller must check that consent collected by another party is valid, documented and covers its own processing.
- Map your role. Controlling the defaults and the universe of recipients can make you a controller, however many opt-out switches the customer has.
- Treat inferred data as sensitive. An app identifier linked to an advertising ID or IP address can reveal a protected characteristic.
- Preserve records. Deleting documentation once you know of an investigation can count against you.
The appeal question remains open. The decision summary itself flags possible weak points for an appeal, including how it qualifies the processing globally rather than per operation. That is the DPO database's analysis, not a prediction. Any appeal would go to Norway's Personvernnemnda, the privacy appeals board.