Norway fines Microsoft's Xandr 92M NOK over Grindr RTB data

Norway's data-protection authority, the Datatilsynet, fined adtech firm Xandr — formerly AppNexus, now part of Microsoft — 92 million NOK (about €8.6 million) for processing sensitive personal data without a legal basis. It is the largest fine the authority has issued to date. The decision targets how Grindr-user data was relayed through real-time bidding (RTB) auctions.

What the regulator found

Between July 2018 and April 2020, Xandr relayed data on Grindr users in Norway through RTB to potentially thousands of companies. The data included information revealing sexual orientation — a special category under the GDPR that requires explicit consent. The authority found Xandr acted as both buyer and seller in the process and had no legal basis for the processing; users were unaware of it.

Xandr argued Grindr was responsible for obtaining consent. The Datatilsynet rejected that. Director General Line Coll put the ruling in one line: "responsibility for data protection cannot be passed on to others." The authority treated Xandr as a joint controller with Grindr and held that it could not rely on a partner's assurances it never verified.

Why it matters for practitioners

This is the enforcement point AppSec, legal and ad-engineering teams should read closely: being a link in an RTB chain that carries sensitive signals is itself a processing activity with its own accountability. A contractual clause telling partners not to send prohibited data does not transfer liability if you never checked.

The fine was calculated on Xandr's own annual turnover, not Microsoft's — Xandr was not part of Microsoft during the violation window. Microsoft said the investigation "focused on conduct that predates Microsoft's acquisition of Xandr" and that it is reviewing its options.

What to do today

1. Map your RTB data flows. Identify which fields leave in bid requests and whether any special-category data (orientation, health, religion) can be inferred or transit indirectly.
2. Stop treating contract clauses as a shield. If you're a controller or joint controller in the chain, "our terms forbid it" won't discharge the obligation — verification will.
3. Document the legal basis for every special-category processing step where you are (or could be) a controller, explicit consent included.

Context

The decision extends a European line of enforcement aimed at the mechanics of RTB itself, after the proceedings around IAB Europe's Transparency and Consent Framework and successive actions against Grindr — the Datatilsynet confirmed a separate €5.8M fine against Grindr in October 2023. The complaint behind this case was lodged in 2020 by the Norwegian Consumer Council (Forbrukerrådet), after privacy group noyb raised the issue. Xandr has three weeks from notification to appeal.