{"id":3505,"date":"2026-10-13T14:39:06","date_gmt":"2026-10-13T14:39:06","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3505"},"modified":"2026-10-13T14:39:06","modified_gmt":"2026-10-13T14:39:06","slug":"xandr-fined-a-record-e8-6-million-for-relaying-grindr-data-revealing-sexual-orientation","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3505","title":{"rendered":"Xandr Fined a Record \u20ac8.6 Million for Relaying Grindr Data Revealing Sexual Orientation"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 13, 2026<\/span><\/span>Data Privacy \/ Compliance<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, \u20ac8.6 million ($9.62 million) for illegally relaying \u200bGrindr users’ sensitive data to advertisers.<\/p>\n

The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the \u00abvery serious\u00bb nature of the breach. The infringements occurred between July 2018 and April 2020.<\/p>\n

\u00abXandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies,\u00bb the Data Protection Authority said<\/a> in a statement.<\/p>\n

The data protection authority said its investigation found that Xandr was a joint controller with Grindr, which meant it was responsible for obtaining users’ consent before processing their data.<\/p>\n

Instead of ensuring they had the legal basis for their own processing of the data, Xandr pointed fingers at Grindr, stating it assumed the online dating app had collected users’ consent to do so,\u00bb it added.<\/p>\n

Xandr was formed by AT&T following its June 2018 acquisition of AppNexus. The name is a reference to Alexander Graham Bell, who founded AT&T in 1885. It was subsequently sold to Microsoft in late December 2021, following which the brand was retired and consolidated<\/a> under the Microsoft Ads umbrella in June 2023.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The case dates back to 2020, when the country’s consumer council, along with Austrian privacy non-profit None of Your Business (noyb), filed a complaint against Xandr, accusing it of unlawfully sharing users’ personal data for commercial purposes without getting users’ explicit consent. Thousands of users in Norway are said to have been subjected to unlawful sharing of their sensitive data as a result of this practice.<\/p>\n

<\/p>\n

\u00abThe essence of the infringement was Xandr’s participation in so-called real-time bidding, where they acted both on the buyer and seller side,\u00bb the watchdog said. \u00abWhen a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem.\u00bb<\/p>\n

\u00abAdvertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user.\u00bb<\/p>\n

The DPA also said the fine was calculated taking into account Xandr’s total annual turnover during the two-year time period, which predates Microsoft’s acquisition. Xandr has three weeks to appeal the decision.<\/p>\n

Responding to the DPA’s decision, noyb described<\/a> the fine as a \u00abmajor blow for the online advertising and commercial surveillance industry\u00bb and said that \u00abcompanies such as Xandr are eventually held accountable for their shady practices.\u00bb<\/p>\n

In a statement shared with Reuters, Microsoft said<\/a> it’s reviewing the decision and assessing its options.<\/p>\n

Last month, Grindr opted to pay \u00a326 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users’ personal information, including their HIV status, with third-parties.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The development comes as a Texas federal judge granted<\/a> final approval of a $177 million AT&T settlement for classes of AT&T consumers whose personal information was exposed in two separate data breaches that took place in March and July 2024. The class-action lawsuit<\/a> was settled<\/a> in November 2025.<\/p>\n

The March 2024 incident involved the publication of a dataset on the dark web containing Social Security numbers. It affected about 7.6 million current AT&T account holders and approximately 65.4 million former account holders, the telecom service provider noted<\/a> at the time.<\/p>\n

The second hack revolved around threat actors illegally downloading AT&T customer data from a third-party cloud platform hosted by Snowflake. The American company said that calls and text message records that occurred between May 1 and October 31, 2022 were compromised for \u00abnearly all\u00bb cellular customers.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Oct 13, 2026Data Privacy \/ Compliance The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, \u20ac8.6 million ($9.62 million) for illegally relaying \u200bGrindr…<\/p>\n","protected":false},"author":1,"featured_media":3506,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[38,3485,3335,108,3763,781,3760,3761,3762,3759],"class_list":["post-3505","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-data","tag-fined","tag-grindr","tag-million","tag-orientation","tag-record","tag-relaying","tag-revealing","tag-sexual","tag-xandr"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3505"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3505\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3506"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}