Microsoft company fined 8,5 million euros following complaint by the Norwegian Consumer Council and noyb

12. oktober, 2026

The Norwegian Data Protection Authority has fined the Microsoft subsidiary Xandr 8,5 million euros million (NOK 92 million) after the Norwegian Consumer Council uncovered that the dating app Grindr processed personal data illegally.

In 2020, the Norwegian Consumer Council exposed how countless companies collect large amounts of personal data through apps. The personal data is compiled, shared and used for surveillance-based advertising.

Based on the findings, the Norwegian Consumer Council together with the data protection NGO noyb filed complaints to the Norwegian Data Protection Authority against the dating app Grindr and five adtech companies, including Xandr (now part of Microsoft Advertising), for violating the General Data Protection Regulation (GDPR).

The Norwegian Data Protection Authority has now concluded that Xandr unlawfully processed personal data about Grindr users. According to the Authority, Xandr is equally responsible with Grindr for ensuring that their data processing for adtech purposes is based on valid consent.

“The collection and use of personal data online is out of control. None of Grindr’s users would even know about the existence of Xandr, let alone be able to understand how the company used their personal data,” says Finn Lützow-Holm Myrstad, Director of Digital Policy at the Norwegian Consumer Council.

The landmark fine comes on the heels of a previous € 6 million (NOK 65 million) fine imposed by the Norwegian Data Protection Authority on Grindr in 2025. This earlier complaint was also raised by the Norwegian Consumer Council and upheld by the Norwegian Court of Appeal.

“This sends a strong signal to all companies with business models built on tracking and profiling consumers online. When companies obtain personal data through the adtech system, they become joint controllers and responsible to ensure consent had been validly obtained in the first place. As long as it is impossible for consumers to give meaningful consent to companies harvesting their data, it is difficult to see how today’s surveillance-based advertising system can be lawful.”

Advertising technology track users everywhere

Digital advertising companies assign identifiers to users so that they can be tracked across websites, apps and platforms. The information is pieced together bit by bit, enabling companies to obtain information about what we like, what we buy, our physical and mental health, sexual orientation and political views.

The compiled information about the user, or the user’s “digital twin”, is then shared on digital advertising bid-exchanges, where the winners get to show users targeted advertising.

“This information is not only used to target advertising, but can also be used to influence political choices and to direct messages at people in vulnerable situations. In worst case scenarios, information about people’s sexual orientation can also lead to discrimination and persecution,” says Myrstad.

“The decision against Xandr over its unlawful processing of personal data for advertising shows the lack of transparency that exists about how our personal data is accessed and processed by multiple players. As the EU considers weakening the definition of personal data, they risk giving free reign to the practices around consent that this decision has deemed illegal. Instead, we need strong data protection rules to protect fundamental rights and consumer trust and reduce the risks associated with sharing and processing of personal data,” says Agustín Reyna, Director General at the European Consumer Organisation (BEUC).

“Together with BEUC, consumer organisations, civil society organisations and companies from across Europe, we have worked to curb the illegal adtech system since 2020. Following this significant decision from the Norwegian Data Protection Authority, we urge all participants in the online adtech system to put an end to these blatantly illegal data sharing practices,“ according to Myrstad.