Microsoft-owned Xandr fined €8.5m under GDPR for data sharing

Published: 12/10/2026
| Norweigian DPA

The Norwegian data protection authority, Datatilsynet, has issued an €8.5 million fine to Microsoft-owned online advertising firm Xandr for violating the EU General Data Protection Regulation (GDPR).

The DPA found that Xandr unlawfully processed personal information, including sensitive data concerning sexual orientation, without a valid legal basis. The decision follows three data protection complaints lodged in 2020 by the Norwegian Consumer Council (NCC) alongside privacy organisation NOYB against dating application Grindr and several adtech companies that received user data via the platform.

NCC research previously found that smartphone apps routinely transmit intimate details about user habits, interests, and behaviour to numerous adtech companies using online tracking identifiers. These companies aggregate vast amounts of personal records to construct detailed profiles for targeted advertising across commercial networks. The development is a significant setback for the industry, underscoring that adtech providers are legally accountable for profiling users and cannot process sensitive behavioural or personal data without valid consent.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.

Read Full Story
MIcrosot, Satya Nadella

Back to news

What is this page?

You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.

The Privacy Newsfeed monitors over 300 global publications, of which more than 3,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.