Microsoft has inherited a $9.6 million privacy problem involving a company it acquired years after the alleged violations occurred.
Norway's data protection authority, Datatilsynet, has fined Microsoft's advertising technology subsidiary Xandr 92 million Norwegian kroner (approximately $9.6 million) for unlawfully processing personal information associated with Grindr users. The conduct took place between July 2018 and April 2020, before Microsoft acquired Xandr in 2022.
The decision spotlights a part of digital advertising that users rarely see: the intermediaries that process information about them to help advertisers compete for ad placements. It also shows how privacy violations committed before an acquisition can become a problem for the company that later takes ownership, even when the new owner was not responsible for the original conduct.
Norway says Xandr processed Grindr user data without consent
In what is known as the largest fine ever issued by the regulatory body, Microsoft's Xandr has been asked to pay 92 million NOK (approximately $9.6 million). The watchdog says the advertising technology processed the data through systems that help advertisers buy and sell ad placements.
Because Grindr is an LGBTQ+ dating app, information associated with its users could reveal their sexual orientation, which is classified as sensitive personal data under Europe's General Data Protection Regulation (GDPR).
BleepingComputer, citing the agency, noted that the regulator found that Xandr assumed Grindr had obtained the required consent but failed to verify it or establish a valid legal basis for its own processing.
The fine ends a more than six-year case, after Austrian nonprofit privacy rights organization Noyb filed the complaint against Xandr in January of 2020. The company, however, has three weeks to appeal.
Why the fine matters beyond Xandr
The case highlights a less visible part of digital advertising: the companies that process personal information behind the scenes to help advertisers buy and sell ad placements.
Users may share information with one platform without realizing that advertising partners and other intermediaries could also receive or process data associated with their activity.
That responsibility is why regulators are increasingly holding companies across the data-sharing chain accountable for their roles. The fine against Microsoft's Xandr over Grindr user data is one example of how that accountability can extend to advertising technology providers, rather than stopping at the app users interact with.
The case is not isolated. Hims & Hers, for instance, has faced scrutiny over its handling of sensitive health information, illustrating the privacy risks that arise when companies collect and use data about people in ways those individuals never consented to.
While the circumstances differ from Xandr's case, the Xandr decision illustrates the regulatory risks for advertising technology providers that rely on data collected by other businesses, particularly when the information could reveal sensitive details about users.
For companies operating in this ecosystem, the case reinforces the importance of verifying consent and understanding their own responsibilities before processing personal information.
Your data doesn't necessarily stay with the platform you shared it with
When you share your personal information with a platform, you may expect it to remain within that service and be used for the purpose you signed up for. However, digital services often rely on third-party companies for advertising, analytics, and other functions, meaning information you provide to one platform can be passed to several other parties.
So what starts as a simple interaction with one service can expose your data to a much wider network of companies than you might expect.
That becomes more concerning when the information involved can reveal sensitive details about your life. Users may have little visibility into these transfers, making it difficult to know who else has access to their information or how it is being used.
The case also shows that privacy compliance obligations extend beyond the platforms users interact with directly. Advertising intermediaries have their own responsibilities when handling personal information, and relying on another company's consent practices may not be enough to satisfy regulators.
For Microsoft-owned Xandr, the immediate question is whether it will appeal the decision. For the broader advertising industry, the ruling reinforces the risks of processing sensitive information without a clearly established legal basis.
Other news: Security researchers detected 135 exploitation attempts targeting a critical SonicWall SMA1000 vulnerability just two days after patches were released.