The Norwegian Data Protection Authority (NDPA) has charged Xandr, an adtech subsidiary of Microsoft, with a fine of 92 million Norwegian kroner, or around $9.6 million. According to the data protection agency, Xandr allegedly didn’t obtain “explicit consent” to use sensitive user data of those on Grindr for advertising purposes, instead only assuming that the dating app already secured user approval. It’s also the highest fine that the Norwegian authority has issued to date.

“When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem,” the NDPA wrote in a press release. “Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user.”

The case started in 2020 when the country’s consumer council filed a complaint against Xandr, which wasn’t owned by Microsoft at the time, with the NDPA. The complaint accused Xandr of unlawfully sharing users’ personal data for commercial purposes without getting consent first. The Norwegian data authority justified the “high fine in this case” due to the data misuse that it considered “very serious.” The NDPA said the fine was calculated from Xandr’s total annual turnover and that the data infringements took place between July 2018 and April 2020.

While Xandr is the accused offender in this case, Grindr has itself been involved in cases of improperly sharing sensitive user data. Previously, the same Norwegian agency charged the dating app with a more than 5.6 million euro fine, or around $6.2 million, for similar reasons. Grindr was also hit with a lawsuit in London in 2024 for allegedly sharing data that included the HIV status and test dates of its users.