Norway Fines Microsoft's Xandr $9.6 Million Over Grindr Ad-Data Sharing

What happened

Norway's Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, NOK 92 million (approximately $9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in Norway, according to BleepingComputer.

Why it matters for defenders

This is a regulatory and privacy enforcement action, not an intrusion, but it's directly relevant to security and privacy teams. Grindr's user base includes individuals whose sexual orientation may be inferred from app usage — a special category of data under GDPR. The case underscores how real-time bidding (RTB) advertising pipelines can leak sensitive attributes to third parties far beyond the originating app, and how regulators are increasingly willing to penalize the ad-tech intermediaries, not just the app vendor, for downstream mishandling of that data.

Organizations running mobile apps that integrate ad SDKs, or security teams responsible for vendor risk and data-protection compliance, should treat this as a reminder that ad-tech data flows are an active enforcement target, with consequences for any vendor in the chain that processes sensitive inferred data without an adequate legal basis.

What defenders and privacy teams should do now

• Inventory which third-party SDKs (especially ad/analytics SDKs) in your mobile or web apps receive data that could reveal special-category attributes (health, sexual orientation, religion, etc.), even indirectly via app identity or category.
• Review data-sharing agreements and consent flows with ad-tech and RTB partners to confirm a valid legal basis exists for any sensitive-inferable data shared.
• Audit outbound network traffic from mobile apps for calls to ad-exchange/RTB endpoints and confirm what data fields are actually transmitted, not just what's documented.
• Coordinate with legal/privacy teams on GDPR Article 9 (special category data) exposure if your app or platform could reveal sensitive attributes through its mere identity or usage pattern.

Developing story

This is a regulatory enforcement action based on currently available reporting, and details such as Xandr's and Microsoft's response or any appeal are still emerging. For the full story, see the original report from BleepingComputer.