Datatilsynet announced a NOK 92 million fine on Xandr, a Microsoft advertising company, over real-time bidding in Grindr. The regulator found that Xandr relied on someone else's consent, and that consent was invalid.
- Norway's Datatilsynet announced a fine of NOK 92 million (EUR 8.6 million) on Xandr Inc., a Microsoft company. The final decision is dated 2 October.
- Xandr processed the fact that people use Grindr, their advertising IDs and their IP addresses during real-time bidding. The regulator counts them as data concerning sexual orientation.
- Xandr relied on Grindr's consent, which the authority holds invalid. Accountability cannot be outsourced: each joint controller must verify for itself.
Xandr did not collect consent itself. It relied on Grindr's. The Norwegian regulator says that consent was invalid, and borrowed consent does not carry over.
The data is simple: that a person uses Grindr, their advertising ID and their IP address. But being in an app like that is itself information about sexual orientation, and that is a special category. For it, the law requires explicit consent.
The key line is in the summary of the decision: “accountability cannot be outsourced”. Each joint controller must independently verify that consent is valid and covers its own processing. That is how the Norwegian authority reads it, for data of users in Norway.
Grindr itself has a separate fine from the same authority, NOK 65 million. The Borgarting Court of Appeal upheld it on 21 October 2025. How Microsoft and Xandr react, and whether they will appeal, the sources do not say.
If you sit in the middle of the advertising chain and receive someone else's data, you must be able to show the consent itself. A contract clause is not enough.