Norway Fines Microsoft Ad Subsidiary Xandr $9.6 Million Over Grindr Data
Norway's Data Protection Authority has fined Xandr 92 million Norwegian kroner, about $9.6 million, for allegedly misusing Grindr user data. Engadget Xandr is an advertising technology subsidiary of Microsoft. The company has three weeks to appeal the order.
The authority said Xandr used sensitive Grindr user data for advertising without explicit consent, meaning clear and direct permission. Xandr had assumed Grindr had already secured that approval. That assumption is the core of the case. The authority dated the infringements to July 2018 to April 2020. It said the fine was calculated from Xandr's total annual turnover.
The penalty is the highest the authority has issued to date. The case started in 2020, when Norway's consumer council filed a complaint against Xandr with the authority. At that point, Xandr was not yet owned by Microsoft.
Grindr faced a separate action in the same chain. Norway's Data Protection Authority imposed a reduced 65 million kroner ($7.14 million) fine on Grindr. Reuters The two penalties address different operators handling the same user data.
The broader context here will be familiar to engineers who work with consent management, the tools for recording permission, and programmatic pipelines, the automated systems that buy and place ads. Assumed consent does not scale across those systems. For sensitive data, the law requires a direct and provable grant, not a contractual expectation that an upstream partner collected it. Consent status must move as first-class data alongside the bid request, the automated request to show an ad, and be enforceable at decision time. Logging matters. If an auditor asks how a sensitive attribute was cleared for advertising use during a specific window, the answer must be reconstructible from records, with scope, timestamp and provenance, not from process diagrams. Turnover-based fines raise the stakes for that discipline. Liability travels with the data.
In my view, this kind of enforcement clarifies rather than chills building. Precise consent plumbing is tedious work, but it is solvable work. Standardized signals, strict validation at ingestion, default-deny handling for sensitive categories, and routine purging of uncleared attributes are all within current practice. Systems that do that reliably earn more durable user trust, and durable trust is what lets personalization and measurement survive regulatory scrutiny. The industry has rebuilt around clearer defaults before, from browser storage to app permissions, and ad infrastructure can do it again. Consent debt behaves like security debt. It compounds quietly until an external review prices it.
