Microsoft's Xandr Fined NOK 92 Million Over Grindr User Data

Every time a free app shows you a banner ad, an auction runs in the background. Before any advertiser bids, the auction house tells the bidders who they are bidding on: which app, which device, which network address. On October 12, 2026, Norway's regulator announced that for Grindr users, that message itself was the violation.

The Norwegian Data Protection Authority (Datatilsynet) fined Xandr Inc., now part of Microsoft, NOK 92 million, "equivalent to €8.6 million," and called it "the highest fine it has issued to date." The target is not the app. It is the middleman that ran the auctions.

Key Takeaways

• Datatilsynet fined Xandr Inc. NOK 92 million in a decision dated October 2, 2026, its highest fine to date, for breaching Articles 6(1) and 9(1) of the GDPR.
• The regulator found Xandr processed, at minimum, the fact that people used Grindr plus their advertising ID and IP address during real time bidding, between July 20, 2018 and April 7, 2020.
• Xandr was ruled a joint controller on both the supply side and the demand side, so relying on Grindr's invalid consent was no defense.
• Grindr itself paid a NOK 65 million fine in February 2026 for sharing the same users' data with ad partners, which makes the ad tech intermediary's penalty about 42 percent larger than the app's.
• Xandr has three weeks from receiving the decision to appeal it.

What Did Datatilsynet Decide?

Datatilsynet decided that Xandr had no legal basis to process Grindr users' data and no valid exemption for processing data about their sexual orientation. The 54 page public version of the decision, dated October 2, 2026, sets out the core finding plainly:

• What was processed: "at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding."
• Why it is sensitive: those data are personal data under Article 4(1) and "data concerning sexual orientation under Article 9(1) GDPR," because using Grindr reveals it.
• Who was responsible: Xandr "is considered a joint controller for the processing, both as supply-side and demand-side platform."
• Why consent failed: Xandr relied on Grindr's consent, which was invalid, and the authority holds "that accountability cannot be outsourced."

The investigation period runs from July 20, 2018, when the GDPR took effect in Norway, to April 7, 2020, the day before Grindr deployed a new consent platform for Norwegian users. Director General Line Coll put the takeaway in one line: "Our key message is that responsibility for data protection cannot be passed on to others."

How Did Grindr Data Reach Xandr?

It traveled through an ad SDK inside the app. On January 14, 2020, the Norwegian Consumer Council published Out of Control, a study that commissioned security firm mnemonic to test ten popular apps. Altogether, the report says, the ten apps were observed "transmitting user data to at least 135 different third parties involved in advertising and/or" behavioral profiling.

For Grindr, the path ran through Twitter's MoPub SDK. The report found that AppNexus, which became Xandr, received "both the unique Advertising ID and the IP address, and the app name through a mediation referral from MoPub." MoPub's own documentation promised to truncate the IP addresses of EU and EEA users, yet the testing showed "the MoPub SDK was transmitting the full IP address to AppNexus."

The same day, the council filed complaints against Grindr and five ad tech companies: Twitter's MoPub, AppNexus, OpenX, AdColony and Smaato. The Xandr decision closes one of those five, nearly seven years after the complaint was filed.

What Does a Bid Request Reveal About You?

A bid request tells potential advertisers which app you are in, which device you hold and, often, who you are in advertising terms. According to the decision, Xandr relied on OpenRTB 2.4, the IAB Tech Lab protocol that was dominant at the time. In that standard, the "app", "device" and "user" objects are recommended parts of a minimal viable bid request.

For a Grindr user, each of those fields carries weight:

• App name or ID: Datatilsynet notes that the app name, app ID or app URL "would disclose what app an individual is using." On Grindr, that alone points to sexual orientation.
• Advertising ID: a persistent device identifier that lets bidders recognize the same phone across apps.
• IP address: a network locator that the Out of Control report says lets companies like AppNexus perform cross device tracking when paired with the advertising ID.
• Extras: the Out of Control report says MoPub mediation referrals included "demographic data such as age and gender, and precise GPS coordinates."

The scale is the part that makes this hard to contain. The 2020 report notes that before AT&T bought it, AppNexus claimed to process 6 million queries per second. By our arithmetic, that is roughly 518 billion queries a day. Datatilsynet's press release says Xandr's bid requests could reach "potentially thousands of other companies."

We covered the same pipeline from the outside in June, when EFF found that Grindr contacted 20 trackers in 15 minutes. This decision goes after one of the auction operators on the receiving end.

Why Is the Fine Based on Xandr, Not Microsoft?

Because Microsoft did not own Xandr when the violations happened. The decision records that AppNexus Inc. was renamed Xandr Inc. on July 1, 2019, and that Microsoft acquired it on June 6, 2022, after the investigation period. Datatilsynet concluded it would not be "appropriate or proportionate" to base the fine on Microsoft's turnover.

That choice capped the penalty. Xandr's own revenue is redacted in the public version, but the decision says 4 percent of it is lower than EUR 20 million, so the legal maximum was EUR 20 million, about NOK 215.8 million. The decision converts the final NOK 92 million to "approximately EUR 8 500 000," which is less than half of that ceiling. The press release uses €8.6 million. Both figures come from the regulator.

The decision lists what moved the number:

• Aggravating: the seriousness and nearly two year duration of the breaches, and the finding that Xandr "must have gained financial benefits" from the sharing.
• Mitigating: the long case handling time, plus Xandr voluntarily attending a February 2025 meeting, which the regulator found "slightly mitigating."
• Rejected: Xandr's argument that industry practice at the time should count in its favor.

One detail stands out. Xandr told the regulator it could not identify any Grindr data it had processed because the records were deleted under its retention policy between July 16, 2020 and February 6, 2023. Datatilsynet notes Xandr had known about the investigation since February 21, 2020, and says that deletion cannot be invoked in Xandr's favor.

Analysis: The Middleman Paid More Than the App

Most coverage will lead with the record amount. The bigger precedent is who paid it. Grindr's NOK 65 million fine from December 2021 was upheld by the Borgarting Court of Appeal on October 21, 2025, and Grindr's 2025 annual report says it paid the principal on February 11, 2026, while disputing NOK 16.8 million in interest. Xandr's NOK 92 million is about 42 percent more than the app's principal, for an intermediary most Grindr users never heard of.

For compliance teams at SSPs and DSPs, the message is in the joint controller finding. Pointing at the publisher's consent banner did not work. Each party in the auction chain is expected to check, and document, that consent is valid for its own processing.

The business context has shifted too. Microsoft announced it would step back from media buying through Microsoft Invest, the former Xandr DSP, "starting on February 28, 2026," in an October 2025 Microsoft Advertising post that names Amazon DSP as its preferred transition partner. The same post says Microsoft is shifting investment to its Microsoft Advertising Platform and to Microsoft Monetize and Curate on the sell side. The fine lands on conduct from 2018 to 2020, not on what Xandr runs today.

noyb, which worked on the original complaints, welcomed the decision and warned that the European Commission's Digital Omnibus proposal would take online tracking IDs out of the GDPR's scope. If that passes, noyb argues, companies including Xandr could no longer be held accountable for breaches involving those IDs.

What This Means for Your Inbox

The identifiers in this case were device IDs and IP addresses, not email addresses. In 2019, MoPub's privacy policy, as quoted in Out of Control, even said its services were "designed to avoid collecting information such as your name, address, or email address." That line no longer describes the whole industry. Unified ID 2.0, an advertising identifier framework, says in its own glossary that UID2 tokens are "generated from hashed or unhashed email addresses or phone numbers."

So the email address you type into an app's sign up form can be more than a login. It can be the seed of an advertising identifier. That raises the stakes on consent screens, which we have shown are often built to push you toward yes, as in our look at dark patterns in email tracking consent. It is also why Grindr's separate UK case over HIV status data sent to service providers matters: sensitive data rarely stays with the company you gave it to.

What Can You Do About Real Time Bidding Leaks?

You cannot see bid requests from your phone, but you can strip out the identifiers that make them personal:

1. Delete your Android advertising ID. Per Google's developer policy page, once you delete it in Settings, apps that ask for it "will receive a string of zeros instead of the identifier."
2. Turn off tracking requests on iPhone. Apple's instructions are Settings, Privacy and Security, Tracking, then switch off Allow Apps to Request to Track.
3. Use a separate email address for sensitive apps. If an address can seed an ad identifier, keep your main one out of dating, health and religious apps.
4. Request your data. The complainant in this case used a GDPR access request to learn that Grindr shared IP address and Google Advertising ID with Xandr. You can send the same request to any app.
5. Complain to a regulator. The Xandr complaint was filed on behalf of a single Norwegian Grindr user.

What Happens Next?

Xandr can appeal within three weeks of receiving the decision, according to Datatilsynet. If Grindr's path is a guide, an appeal could run through the Privacy Appeals Board, the Oslo District Court and the Court of Appeal, a sequence that took Grindr almost four years. The complaints against MoPub, OpenX, AdColony and Smaato are the ones to watch next.