Reported by 1 outlet
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 1.00 / 2.0 · updates in 48h
- Pickup speed
- 0.39 / 0.6 · time to second source
- Recency
- × 0.54 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 2.2 / 10 = base × recency + community
Analysis
Norway's data protection authority Datatilsynet fined Microsoft-owned advertising firm Xandr $9.6 million (NOK 92 million) for unlawfully sharing sensitive Grindr user data. Between July 2018 and April 2020, Xandr ran real-time ad auctions inside Grindr that exposed users' profiling information, including sexual orientation, to thousands of bidding companies. Xandr acted as joint controller but did not verify Grindr's consent. This is the largest fine the authority has issued. Thousands of Norwegian users were affected.
The breach highlights failure of ad-tech intermediaries to validate consent for sensitive data categories. The fine targets Xandr rather than Grindr directly. The event text references BleepingComputer. No exploitation claims are made; the issue is regulatory enforcement. Watch for similar actions in other EU jurisdictions.
Timeline
-
original reporting
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
bleepingcomputer.com · 1d ago · October 12th, 2026
Norway’s Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, $9.6M (NOK 92 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. The data protection authority said this is the largest fine it has ever issued. “We issued such a high fine in this case because the breaches we identified were very serious,” said Line Coll, Director General of Datatilsynet. “Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.” According to the authority’s findings, between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that potentially exposed users’ data, including sensitive sexual orientation information, to thousands of companies. These auctions work by advertisers bidding for the right to display an ad to a Grindr user after they receive profiling information from Xandr, which acted as the intermediary. At the time, Xandr was a joint controller with Grindr, meaning it was responsible for how the data was used and should have required and obtained explicit consent from the data subjects for this processing. Grindr is a location-based dating app primarily serving the LGBTQ+ community. According to Norway's data privacy agency, Xandr assumed Grindr had obtained valid consent but did not take any action to verify it. “Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had
-
update from www.bleepingcomputer.com
🗞 Norway fines Microsoft ad firm $9.6 million over Grindr data sharing via BleepingComputer https://www. bleepingcomputer.com/news/secu rity
www.bleepingcomputer.com · 22h ago · October 13th, 2026
🗞 Norway fines Microsoft ad firm $9.6 million over Grindr data sharing via BleepingComputer https://www. bleepingcomputer.com/news/secu rity
via Mastodon https://www.bleepingcomputer.com/news/security/norway-fines-microsoft-ad-firm-96-million-over-grindr-data-sharing/