Norway's fine on Xandr over Grindr user data in real-time bidding

The Norwegian Data Protection Authority (Datatilsynet) announced on 12 October a fine of NOK 92 million (about €8.5 million according to the decision) on Xandr, an advertising technology company owned by Microsoft, the highest fine the authority had issued at the time of the announcement. According to the decision of 2 October, Xandr had no legal basis when it processed data on Grindr users in Norway through real-time bidding from July 2018 to April 2020, and the data included at least the fact that a person used Grindr, the advertising ID (an identifier the phone's operating system assigns to each device for advertising) and the IP address. The fine covers only users in Norway, and the decision contains no assessment of current practice. According to an explainer the authority published on 16 October, every time someone opens an app with ads, this kind of auction may be triggered.

Real-time bidding (RTB) is the mechanism by which an app or website with ad space sends user data to advertising platforms so that advertisers can bid for it within a fraction of a second. According to the decision, when a user opened Grindr, the ad request went to Xandr either directly or through MoPub, an ad mediation service. Xandr ran platforms on both the seller and buyer sides at the time, and according to the authority's press release the data could be passed on to thousands of companies.

In its decision, the authority held that using Grindr is itself information that indicates sexual orientation, which makes it special category personal data under the EU's General Data Protection Regulation (GDPR, which also applies in the European Economic Area that Norway belongs to). Processing such data is prohibited in principle, and explicit consent is one of the exceptions. According to the authority's press release, Xandr's defence was that it thought Grindr had obtained users' consent. The authority concluded that the consent Grindr collected was invalid, and that Xandr, as a joint controller (one of the companies jointly deciding how data is processed), had to verify for itself that consent was valid and could not pass the responsibility on to others.

The case grew out of complaints the Norwegian Consumer Council and noyb, a European privacy advocacy group, filed in 2020 against Grindr and several adtech companies. Grindr itself was fined NOK 65 million in December 2021, a fine upheld in turn by the Privacy Appeals Board, the Oslo District Court and the Court of Appeal. According to the authority's annual report for 2025, the Court of Appeal's judgment of October 2025 was not appealed further and is final.

Perspective

A Microsoft spokesperson told netzpolitik.org, a German digital policy outlet, that the investigation and decision concern conduct before Microsoft acquired Xandr, and that the interpretation of legal standards and practice has developed since. The spokesperson added that the company is reviewing the decision and evaluating its options.

According to the decision, Xandr argued that when the investigation began, neither it nor any company in the same position could have foreseen the standards and conclusions the authority applied. The authority took this to mean industry practice, and citing the Court of Appeal, held that industry practice cannot count as a mitigating factor.

The fine was calculated on Xandr's own annual turnover. Relying on case law of the Court of Justice of the EU, the authority found that because Xandr was not part of Microsoft during the period of the infringement, using Microsoft's turnover would be neither appropriate nor necessary.

Xandr objected to basing the fine on revenue for the 2025 fiscal year, because the authority took more than a year after its advance notification (the notice before a decision) to issue the decision. The authority still used that year's revenue, but counted the long handling time as a mitigating factor and reduced the fine. Xandr also argued that the delay had harmed its ability to defend itself, which the authority did not accept.

The deadline to appeal is three weeks from receipt of the decision, and the date of receipt has not been made public. As of 31 October, the authority's English news page had no follow-up announcement.

On 12 October, noyb linked the fine to the EU's Digital Omnibus (a proposal the European Commission put forward in November 2025 to simplify digital rules), arguing that industry lobbying aims to take identifiers used for online tracking out of the GDPR. The European consumer organisation BEUC, for its part, is concerned that loosening the definition of personal data would leave the kind of consent practice found unlawful in this case without constraint.

According to the Council of the EU's press release of 21 October, the position agreed by member states keeps the existing definition of personal data and adds new provisions on pseudonymisation (replacing fields that directly identify a person with codes).

The same press release states that the new provisions aim to make it clearer to organisations how to comply. In noyb's reading of 23 October, the new pseudonymisation provisions would drastically narrow what counts as personal data.

On Android, the advertising ID can be deleted under Settings > Privacy > Ads, and on an iPhone, Settings > Privacy & Security > Tracking lets you turn off "Allow Apps to Request to Track", or turn tracking off app by app. Under Apple's rules for apps, once a user asks an app not to track, the app may not track the user with other information that identifies the user or the device either. According to Google's help page, apps may have their own settings using other types of identifiers. Neither company's page says whether the IP address and which app is in use are still sent with ad requests, so we cannot confirm whether these settings cover the other data named in the decision.

The decision contains no information about users or current practice in Asia. We, a community based in Taiwan, compared Taiwan, Japan and mainland China on two points from the case: whether using an app counts as sensitive data, and whether each company along the ad chain has to deal with consent itself. We did not check how regulators or courts in these places interpret the use of a particular app.

Article 6 of Taiwan's Personal Data Protection Act lists data on sex life, together with medical records, genetic data and criminal records, as data that in principle may not be collected, processed or used, with written consent as one of the exceptions, subject to limits: such consent does not count where the use goes beyond what the specific purpose requires or is against the person's will. The article does not mention sexual orientation. We did not check whether every company along an ad chain has to deal with consent itself under the Act, which has no provision specifically on advertising identifiers or real-time bidding.

Under Article 20 of Japan's Act on the Protection of Personal Information, acquiring "special care-required personal information" requires the person's prior consent outside the listed exceptions. The categories in the Act and its Cabinet Order include race, creed, social status, medical history and criminal record, and neither they nor the general guidelines of the Personal Information Protection Commission list sexual orientation.

The Commission's guidelines give browsing histories collected through cookies and other device identifiers, and records of the services a person uses, as examples of "personally referable information". Under Article 31, when the recipient is expected to acquire such information as personal data identifying the person, the company providing it has to confirm beforehand that the person's consent has been obtained. According to section 3-7-2-2 of the guidelines, the consent is to be obtained by the recipient, which deals with the person and uses the information, though the provider may obtain it on the recipient's behalf, provided the person's rights are equally protected.

In Norway the company receiving the data was held responsible for checking the consent collected upstream, while for personally referable information under Article 31 the check sits with the company providing it (our comparison). A company acquiring special care-required personal information has to obtain the person's prior consent itself under Article 20(2). Article 30(1) separately requires a company receiving personal data from a third party to confirm the provider's name and address and how the provider acquired the data, unless an exception in Article 27(1) or (5) applies.

Article 28 of mainland China's Personal Information Protection Law lists biometrics, religious belief, specific identity, medical health, financial accounts, whereabouts and similar information as sensitive personal information, without mentioning sexual orientation, and under Article 29 handling sensitive personal information requires the person's separate consent. A January 2026 Q&A by the Cyberspace Administration of China, citing the national standard GB/T 45574-2025, lists common categories of sensitive personal information without sexual orientation, and we did not read the standard itself.

The Norwegian conclusion concerned Xandr's responsibility as a joint controller, which corresponds to Article 20 of the Chinese law (our comparison). Handlers that jointly decide the purpose and method of processing must agree on their respective rights and duties, and under Article 20(2) they are jointly and severally liable for harm to rights and interests in personal information. Providing personal information to another handler is a different relationship covered by Article 23, under which the provider itself has to tell the person who the recipient is, its purpose and the types of information and obtain separate consent, while the recipient has to stay within that purpose, method and scope or obtain consent again. Unlike Japan's Article 31, where the provider confirms that consent has been obtained, Article 23 has the provider obtain the consent (our comparison), and we did not check whether passing data along an ad chain counts as joint processing or as provision under Chinese law.

Comparing approaches across places, readers can ask whether using an app is treated as sensitive data, and whether every company along the ad chain that receives the data has to verify consent itself. Another question is how regulators assess past practice when a company argues that the interpretation of legal standards has since developed. If other places follow the Digital Omnibus in adjusting the definition of personal data, whether identifiers used for tracking remain covered is also worth comparing. The intended effect of the policy matters too: this case went from complaint in 2020 to decision in 2026, and the question is whether the fine can change what companies do now.