What Norway's Xandr fine actually assesses

What happened

Norway's data protection authority fined Xandr Inc. NOK 92 million for processing personal data of Grindr users in Norway. The public decision, published through the Norwegian Consumer Council, says the processing lacked a legal basis under Article 6 of the GDPR and that special-category data concerning sexual orientation lacked a valid exemption under Article 9. The authority's own press note, dated for release on October 12, 2026, calls the amount its highest fine and quotes director general Line Coll on the seriousness of the breaches. The decision text, not a headline conversion into euros, is the record. The page filing it is Futureweb.

What the decision says was processed

The executive summary says the authority found it proven, by clear preponderance of probability, that Xandr processed at least the fact that individuals were using Grindr, their advertising identifiers, and their IP addresses, during real-time bidding. It treats those as personal data, and as data concerning sexual orientation. It says Xandr is a controller for the processing. It also records that AppNexus was renamed Xandr on July 1, 2019, and that Microsoft acquired Xandr on June 6, 2022, after the period under review. The desk for a fine about data that left an app is Privacy.

What the announcements add

The Norwegian Consumer Council, on October 12, describes the fine as 8.5 million euros and says the council and noyb complained to the authority against Grindr and five advertising companies, including Xandr. The authority's press note describes the same NOK 92 million as equivalent to 8.6 million euros, says thousands of users in Norway were affected, and says the infringements ran from July 2018 to April 2020. It says the amount used Xandr's turnover, not Microsoft's, because Xandr was not part of Microsoft in that period. It says Xandr has three weeks from receipt to appeal. A key that stays with the holder is a different privacy fact, filed as the key stays with the holder.

Why it matters on this desk

The dependency is an administrative fine with a file: who was fined, for which processing, over which years, and in what currency the decision itself uses. The decision uses Norwegian kroner. Euro figures in the council's note and the authority's press note do not match each other, so this page keeps both and does not pick a conversion. What a session cannot be, a standing limit on a different kind of identifier, is what a session cannot be.

Where the euro figures differ

The consumer council's October 12 page says 8.5 million euros. The authority's press note says 8.6 million euros. Both are describing NOK 92 million. This page will not average them into a third number. The kroner figure is the one in the decision's executive summary: NOK 92,000,000. A later exchange-rate note, if the authority publishes one, can replace the euro gloss. Until then the disagreement is part of the record, and it is smaller than the fact of the fine.

What this page will not add

It will not describe an auction protocol, a bid request, or a list of downstream buyers. It will not treat a secondary writeup of deleted files as part of the executive summary this desk has read. It will not say Microsoft operated the processing in 2018. The decision says the acquisition was in 2022. The security desk, for an advisory that names a flaw rather than a fine, is Security.

What to watch next

An appeal within the three weeks the authority named would change the status of the fine from a decision to a decision under challenge. A correction of the euro gloss by either the council or the authority would retire one of the two conversions. A second decision against a different company named in the original complaints would be a new file, not a revision of this one. The redacted decision and the October 12 notices are the record.

What would change the record

A court ruling on an appeal would replace the fine's finality. A revised public version of the decision that changes the kroner amount, the years, or the categories of data would replace those sentences. Another outlet converting NOK 92 million at a new rate would not, unless the authority adopts that rate. The consumer council is the complainant speaking on October 12. The authority is the office that issued the fine. The PDF is the decision.

What stays a kroner fine

What stays specific is a Norwegian decision fining Xandr Inc. NOK 92 million for processing Grindr users' data in Norway, including the fact of using the app, advertising identifiers, and IP addresses, in real-time bidding, from July 2018 to April 2020, under Articles 6 and 9. Microsoft's acquisition date in the decision is June 6, 2022. The council says 8.5 million euros. The authority's press note says about 8.6 million euros and gives three weeks to appeal. This page does not collapse those conversions. It also does not describe how an ad auction is built. The fine is the fact. The mechanism of a bid is not required to file it. Line Coll is the director general the press note quotes. The three-week appeal clock starts when Xandr received the decision, and the note does not print that receipt date.