Grindr users in Norway had sensitive personal information shared through online advertising auctions without valid consent, according to the country's privacy regulator. The case involved commercial data processing, not a reported cyberattack.
On 12 October 2026, Norway's Data Protection Authority, Datatilsynet, announced a NOK 92 million (approximately €8.6 million) fine against Microsoft's advertising subsidiary Xandr.
The violations occurred between July 2018 and April 2020.
During that period, information identifying people as Grindr users could reach potentially thousands of companies participating in advertising auctions. Thousands of Norwegian users were affected, according to the regulator.
The case highlights a privacy risk that extends beyond hacking.
Simply using a dating app can reveal sensitive information to advertisers, even when users have not explicitly disclosed their sexual orientation.
How Grindr Users' Data Reached Advertisers Without a Hack
The information was processed through real-time bidding, an automated system that allows advertisers to compete for advertising space on websites and mobile apps.
When someone opened Grindr, their personal data was, in many cases, relayed through Xandr to companies participating in advertising auctions.
Advertisers could then bid to display targeted adverts. These transactions happened in fractions of a second, often without users knowing which companies might receive their information.
According to Datatilsynet, using Grindr could itself indicate sexual orientation.
The location-based dating app primarily serves gay, bisexual, transgender and queer people. Under the General Data Protection Regulation (GDPR), personal information revealing sexual orientation receives special protection.
Users did not need to state their sexuality for their app usage to suggest it.
Such inferences can be sensitive even when inaccurate. The violations involved personal data being processed and shared through advertising systems without valid consent, rather than a reported security breach.
Why Microsoft-Owned Xandr Was Fined
Norway's regulator found that Xandr lacked a valid legal basis to process the sensitive information. The company assumed Grindr was responsible for obtaining users' consent but had not verified whether that consent was valid.
Datatilsynet rejected that explanation.
It found that Xandr and Grindr were joint controllers of the personal data, meaning both had responsibilities under GDPR. Explicit consent was required, but Xandr had failed to ensure it had been obtained.
The NOK 92 million penalty is the largest fine Datatilsynet has imposed.
The regulator considered the seriousness and duration of the violations, alongside Xandr's direct financial benefit from the unlawful processing. The fine was calculated using Xandr's annual turnover, not Microsoft's revenue. The violations occurred before Microsoft completed its acquisition of Xandr on 6 June 2022.
In a statement reported by Reuters, Microsoft said user privacy remained a priority. It noted that the conduct predated its acquisition and that legal interpretations and practices had evolved.
The company said it was reviewing the decision and assessing its options. Xandr has three weeks from receiving the decision to appeal.
Grindr Was Already Fined Over Related Privacy Violations
The investigation followed complaints filed in 2020 by the Norwegian Consumer Council and privacy organisation noyb. Their concerns centred on how mobile apps shared personal information with advertising companies, often without users understanding the extent of that sharing.
Grindr previously received a NOK 65 million fine in December 2021 for related privacy violations. Norway's Borgarting Court of Appeal upheld that penalty on 21 October 2025. The latest decision focuses on the responsibilities of an advertising intermediary involved in processing users' data.
The case also highlights the difficulty of tracing personal information once it enters the advertising ecosystem. Data shared with multiple companies can be combined with other information, potentially revealing detailed insights about individuals.
Privacy organisation noyb welcomed the decision on 12 October.
Its data protection lawyer, Felix Mikolasch, described the outcome as 'a valuable precedent for similar cases'. The organisation said advertising intermediaries should be held accountable for their own processing practices.
Could Other Dating Apps Expose Sensitive Information?
The ruling raises wider questions about what advertising systems can learn from the apps people use.
Dating services are not the only concern. Apps associated with health, religion and other private matters could also reveal sensitive information through tracking data.
However, the decision does not establish that other dating apps have committed similar violations. It concerns specific practices involving Grindr and Xandr between 2018 and 2020.
It also does not establish that the same unlawful processing continues today.
Users can take precautions by limiting optional profile information, reviewing app permissions and restricting advertising tracking where possible. These measures may reduce some exposure, but they cannot guarantee that information about app usage will never reach advertising partners.
For affected Grindr users, the documented problem was not stolen passwords or compromised accounts. Their sensitive information was processed through an advertising system without the required legal basis.
Norway's decision reinforces a key GDPR principle: companies handling personal data must establish and document their own lawful basis for doing so, regardless of who originally collected it.
