Norway fines Xandr NOK 92 million over Grindr advertising data

On 12 October 2026, Norway's data protection authority announced a NOK 92 million fine against Xandr for unlawfully processing personal data received through Grindr's advertising system. The 2 October decision concerned processing from July 2018 to April 2020.

The authority found Xandr to be a joint controller with Grindr. Because the data revealed sexual orientation, explicit consent was required; Xandr had failed to ensure that valid consent existed. For advertising privacy teams, the case supports checking the sensitivity of received data and verifying consent evidence instead of relying on a supplier's assurance.

Subsequent update: on 3 November, the authority confirmed that Xandr had not appealed and the decision was final. The joint-controller finding concerns the processing assessed in this case; other recipients must evaluate their own role and data flows.