A Record Penalty in Norway
Norway's data protection authority, Datatilsynet, has issued its largest-ever administrative fine: €8.6 million (roughly $9.62 million) against Xandr, the advertising technology subsidiary owned by Microsoft. The penalty centers on the company's role in passing sensitive information about Grindr users to advertisers — data that, in combination, could reveal a person's sexual orientation.
Datatilsynet described the underlying infringement as "very serious," a characterization that helps explain why the watchdog departed from its previous penalty levels. The decision underscores a growing regulatory focus on the adtech ecosystem, where behavioral data is routinely enriched, combined, and shared at scale.
What Xandr Was Accused Of
Grindr is a dating and social networking app primarily used by gay, bisexual, and other men who have sex with men. Because the app's user base is strongly associated with a particular community, information about who uses it — or even inferences drawn from device and usage signals — can expose sexual orientation, one of the categories of data that European privacy law treats with heightened protection.
According to the Norwegian regulator, Xandr relayed Grindr users' data to advertisers without a valid legal basis. The concern is not merely that identifiers were shared, but that the context of the sharing made the data effectively sensitive. Under the EU's General Data Protection Regulation (GDPR), special categories of personal data — including data concerning sexual orientation — require a higher standard of justification and explicit safeguards.
The fine represents the largest penalty Datatilsynet has ever handed down, signaling that the authority views the mishandling of special-category data in advertising pipelines as a priority enforcement area.
Why This Case Matters Beyond Norway
Norway is not a member of the European Union, but it participates in the European Economic Area and applies the GDPR through the EEA Agreement. That means Datatilsynet's decisions carry weight well beyond its borders, and the authority has a track record of taking assertive positions on adtech and tracking. The Xandr case fits into a broader pattern of European regulators scrutinizing how personal data flows through real-time bidding systems and audience segmentation platforms.
The size of the fine also reflects a recurring theme in GDPR enforcement: penalties are often calibrated not only to the severity of the violation but to the company's turnover and the deterrent effect needed. For a Microsoft-owned entity, an eight-figure fine in euro terms is notable but not existential — which is precisely why regulators sometimes escalate to make an example of a case involving vulnerable groups or highly sensitive inferences.
The Adtech Reckoning Continues
For years, privacy advocates have argued that programmatic advertising is structurally incompatible with GDPR principles such as data minimization, purpose limitation, and consent. The argument goes like this: even when a user consents to seeing ads, they rarely understand the chain of intermediaries that receive their data, nor the inferences that can be drawn when multiple data points are stitched together.
Grindr itself has been the subject of privacy scrutiny in the past, and the Norwegian case shows that regulators are willing to look at the entire data supply chain — not just the app that collects information, but the adtech firms that relay it onward. That has implications for publishers, demand-side platforms, data brokers, and the brands that buy audience segments.
Practical Takeaways for Security and Privacy Teams
Organizations that handle audience data should treat this enforcement action as a prompt to revisit several fundamentals:
- Map the data supply chain. Know every party that receives user data, what fields are shared, and what can be inferred when those fields are combined with other signals.
- Treat inferences as data. Even if you never collect a user's sexual orientation directly, a pattern of app usage or membership in an audience segment may amount to special-category data under the GDPR.
- Re-examine consent flows. Consent must be specific, informed, and freely given. Blanket consent buried in lengthy privacy policies is increasingly unlikely to survive regulatory scrutiny.
- Apply data minimization by default. If an advertising use case does not require a sensitive attribute, do not transmit it — and consider whether the attribute can be inferred from what remains.
- Document legal bases. For special-category processing, the legal basis and any applicable exemptions should be documented and defensible before data flows, not after a complaint arrives.
What Comes Next
Xandr has the option to appeal the decision, and GDPR cases frequently wind through national courts before becoming final. Regardless of the outcome, the Norwegian action adds momentum to a European enforcement trend that treats adtech data flows as a compliance risk rather than a background detail. For companies operating in the EEA, the message is straightforward: sensitive inferences deserve the same protection as sensitive facts — and regulators are increasingly prepared to levy record fines to prove it.