The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers.
The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements occurred between July 2018 and April 2020.
"Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies," the Data Protection Authority said in a statement.
The data protection authority said its investigation found that Xandr was a joint controller with Grindr, which meant it was responsible for obtaining users' consent before processing their data.
Instead of ensuring they had the legal basis for their own processing of the data, Xandr pointed fingers at Grindr, stating it assumed the online dating app had collected users' consent to do so," it added.
Xandr was formed by AT&T following its June 2018 acquisition of AppNexus. The name is a reference to Alexander Graham Bell, who founded AT&T in 1885. It was subsequently sold to Microsoft in late December 2021, following which the brand was retired and consolidated under the Microsoft Ads umbrella in June 2023.
The case dates back to 2020, when the country's consumer council, along with Austrian privacy non-profit None of Your Business (noyb), filed a complaint against Xandr, accusing it of unlawfully sharing users' personal data for commercial purposes without getting users' explicit consent. Thousands of users in Norway are said to have been subjected to unlawful sharing of their sensitive data as a result of this practice.
"The essence of the infringement was Xandr's participation in so-called real-time bidding, where they acted both on the buyer and seller side," the watchdog said. "When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem."
"Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user."
The DPA also said the fine was calculated taking into account Xandr's total annual turnover during the two-year time period, which predates Microsoft's acquisition. Xandr has three weeks to appeal the decision.
Responding to the DPA's decision, noyb described the fine as a "major blow for the online advertising and commercial surveillance industry" and said that "companies such as Xandr are eventually held accountable for their shady practices."
In a statement shared with Reuters, Microsoft said it's reviewing the decision and assessing its options.
Last month, Grindr opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal information, including their HIV status, with third-parties.
The development comes as a Texas federal judge granted final approval of a $177 million AT&T settlement for classes of AT&T consumers whose personal information was exposed in two separate data breaches that took place in March and July 2024. The class-action lawsuit was settled in November 2025.
The March 2024 incident involved the publication of a dataset on the dark web containing Social Security numbers. It affected about 7.6 million current AT&T account holders and approximately 65.4 million former account holders, the telecom service provider noted at the time.
The second hack revolved around threat actors illegally downloading AT&T customer data from a third-party cloud platform hosted by Snowflake. The American company said that calls and text message records that occurred between May 1 and October 31, 2022 were compromised for "nearly all" cellular customers.
