Developing
Xandr has three weeks to appeal; the reduction for the authority's own delay was not quantified.
In 60 seconds
- Datatilsynet fined Xandr (formerly AppNexus, bought by Microsoft in 2022) NOK 92 million, its highest fine to date.
- Xandr received and passed on Grindr users' data from July 2018 to April 2020 without a valid legal basis; the data reveals sexual orientation.
- The complaint was filed on January 14, 2020 by the Norwegian Consumer Council with noyb; the case took nearly seven years.
- The fine was based on Xandr's own turnover and reduced for the authority's slow handling.
Impact Layer
- What changed
- A European regulator has penalised an ad tech platform for acting on data it did not check for consent.
- Why it matters
- It shows that platforms in the bidding chain can be held responsible as joint controllers for consent they did not verify.
- Who is affected
- Ad exchanges, DSPs and SSPs, and publishers and apps that pass data into bidding.
- Martech stack area
- Advertising, Data
- Stack impact
- Review how your partners verify consent for special category data, and what you do if a data source reveals sensitive attributes.
- Business impact
- High PPC Land's reading of the decision and press release. Xandr's turnover is redacted and the delay reduction was not disclosed; whether Xandr appeals is not stated.
- Related technologies
- What to watch
- Whether Xandr appeals within three weeks and whether other authorities act on related complaints.
Norway’s data protection authority, Datatilsynet, fined Xandr NOK 92 million in a decision dated October 2, 2026, made public on October 12, according to PPC Land.
The finding
- Xandr (formerly AppNexus, bought by Microsoft in 2022) received and passed on Grindr users’ data from July 2018 to April 2020 without a valid legal basis.
- Because Grindr use reveals sexual orientation, the data is special category data under GDPR Article 9, which requires explicit consent.
- The authority found Xandr was a joint controller and did not verify that consent existed.
- The data included at least the app name, advertising ID and IP address.
The fine
- NOK 92 million; the press release says €8.6 million, the decision about €8.5 million. It is the authority’s highest fine to date.
- Based on Xandr’s own turnover, not Microsoft’s, because Xandr was not part of Microsoft at the time.
- The authority counted its own slow handling as a mitigating factor under Article 83(2)(k); the size of the reduction was not disclosed.
- Xandr deleted records during the investigation, which the decision says cannot be used in its favour.
Timeline
The complaint was filed on January 14, 2020 by the Norwegian Consumer Council with noyb. Grindr was fined NOK 65 million in December 2021 and lost its final appeal on October 21, 2025. Xandr has three weeks to appeal.
Our read
The lesson for bidding chains is plain: receiving data is not enough; you need evidence that consent exists, especially for sensitive categories.
Sources
- PPC Land: Norway fines Xandr NOK 92m over Grindr data after nearly seven years (opens in a new tab)
Source for the decision, amount, timeline, reasoning and gaps.