Norway fines Microsoft ad firm Xandr $9.6 million over Grindr user data sharing
Regulatory enforcement action highlights privacy compliance failures in ad tech ecosystem
Key Takeaways
- Norway's Data Protection Authority fined Xandr NOK 92 million ($9.6 million) for unlawful processing and sharing of Grindr user data.
- The enforcement action was taken under Norwegian privacy regulations equivalent to GDPR.
- No cybersecurity vulnerability or exploitation was involved; the case concerns regulatory compliance in data handling.
- The ad tech industry should review data processing practices and consent mechanisms to ensure compliance with privacy laws.
Quick answers
- What happened?
- Norway's Data Protection Authority has imposed a NOK 92 million ($9.6 million) penalty on Xandr, a Microsoft-owned advertising company, for unlawfully processing and sharing sensitive personal data belonging to Grindr users in Norway. The enforcement action underscores heightened scrutiny of data handling practices within the digital advertising sector.
- What should defenders do?
- Xandr and Microsoft should implement comprehensive compliance measures, update data handling practices, ensure proper user consent mechanisms for sensitive data processing, and review data sharing agreements with third-party apps like Grindr to prevent future violations.
Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. The penalty stems from an investigation into Xandr's data practices, which were found to violate Norwegian privacy regulations regarding the handling of sensitive personal information. The fine represents one of the significant regulatory actions taken against ad tech companies in recent years, reflecting the authorities' focus on compliance with data protection laws. According to reports, the violation involved the processing and sharing of Grindr users' sensitive data without proper legal basis or user consent. The Datatilsynet action serves as a reminder to the ad tech industry of the importance of lawful data processing practices and robust user consent mechanisms. No exploitation of vulnerabilities was reported; this case involves regulatory enforcement related to data privacy compliance rather than a cybersecurity breach or malware incident.
Security Details
This incident is a regulatory enforcement action regarding unlawful data processing and sharing practices. No software vulnerabilities, exploits, or malware were involved. The fine was imposed by Datatilsynet for violations of Norwegian privacy regulations.
Mitigation
Xandr and Microsoft should implement comprehensive compliance measures, update data handling practices, ensure proper user consent mechanisms for sensitive data processing, and review data sharing agreements with third-party apps like Grindr to prevent future violations.
Sources
BleepingComputer
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
Oct 12, 2026 · 20:13
Original link
Related Security News
Denmark CPR Data Breach Exposes 8.8 Million Records via Company Account Access
On October 5, 2026, Denmark's digitalization ministry disclosed that unauthorized parties accessed the Central Person Register (CPR), exposing sensitive data including names, addresses, and CPR numbers for approximately 8.8 million individuals, both living and deceased. The breach was facilitated through a private Danish company's lawful right to query the register, though the exact exploitation method remains unspecified in available reports.
