Norway's data protection authority has fined Microsoft's Xandr roughly €8.5 million over its handling of Grindr users' personal data, including sensitive information about sexual orientation. The Xandr Grindr data fine is notable because it targets a company further along the advertising chain, not just the app that collected the data in the first place.

The summary we have of the decision is brief, so this post sticks to what is confirmed and explains the broader context for readers.

What Norway's Regulator Fined Xandr For

According to the reporting, the penalty of roughly €8.5 million relates to how Xandr, a Microsoft-owned advertising business, handled personal data belonging to Grindr users. That data included sensitive information about sexual orientation.

This is not the first time Grindr's data practices have drawn scrutiny from Norway. The country's data protection authority previously fined Grindr itself 65 million Norwegian kroner (around €5.5 million) for breaching Article 9 of the GDPR, which restricts the processing of special categories of personal data. That fine was later upheld by the Borgarting Court of Appeal. The new action against Xandr extends the focus from the app to a company that handled the data downstream.

How Sensitive App Data Reaches Ad Platforms

Most free apps make money through advertising. To show relevant ads, an app may pass information about a user, such as a device identifier, approximate location, or profile details, to advertising partners. Those partners can include ad exchanges and platforms that match ads to audiences, often within milliseconds of an app opening.

The problem arises when the information involved is sensitive. Under the GDPR, data revealing sexual orientation belongs to a protected category. Simply being a user of certain apps can itself reveal something sensitive. Once that signal enters an ad-tech pipeline, it can be copied, combined with other identifiers, and passed between several companies, which makes it hard for users to know where it ended up or to withdraw it.

That is why regulators look at the whole chain. A company that receives or processes such data takes on its own legal responsibilities, even if it was not the one that first collected it.

What GDPR Enforcement Means for Users

The fine is a signal that European regulators are willing to pursue companies across the advertising ecosystem, including those owned by large technology groups. For users, there are a few practical takeaways.

  • Special category data carries stricter rules. Information about sexual orientation, health, religion, and similar topics generally cannot be processed without a valid legal basis under the GDPR.
  • Enforcement can be slow. The earlier Grindr case went through a fine, an appeal, and a court ruling. Regulatory action does not undo exposure that has already occurred.
  • Fines are not the same as remedies. A penalty punishes a company, but individuals still need to manage their own exposure going forward.

Companies of this size also hold large volumes of data in other contexts, and security incidents elsewhere in the ecosystem are a reminder that data held centrally is a target. For example, we reported on a teen bug hunter who reportedly gained admin-level access to Microsoft's internal Titan analytics service, and on claims that employee databases were stolen from Microsoft Azure infrastructure. These are separate matters from the Xandr decision, but they illustrate why limiting what you share in the first place matters.

What This Means For You

You cannot see which ad partners receive data from an app, so the most reliable approach is to reduce what the app can send. Here is where to start:

  • Review app permissions. Check location, contacts, photos, and tracking permissions on your phone. Revoke anything an app does not clearly need.
  • Reset or disable your advertising ID. Both Android and iOS let you delete or reset your advertising identifier, or limit ad tracking, which makes it harder for ad platforms to link activity across apps.
  • Look at in-app privacy settings. Many apps include toggles for personalized ads or data sharing with partners. Turn off what you can.
  • Be selective with sensitive profile details. If an app asks for information you would not want shared, consider leaving it blank.
  • Delete accounts you no longer use. Dormant accounts can still hold data.

Where a VPN fits

A VPN can mask your IP address and encrypt your traffic between your device and the VPN server, which is useful on public Wi-Fi and for limiting what your internet provider sees. But it does not stop an app from sending the data you have given it, such as profile details or an advertising ID, to its partners. Treat a VPN as one partial layer, not a fix for in-app data sharing.

Key Takeaways

The Xandr Grindr data fine shows that regulators are looking beyond the apps that collect sensitive information to the ad-tech companies that process it. For everyday users, the most effective steps are within your control: audit app permissions, reset or disable your advertising ID, adjust in-app privacy settings, and use a VPN only for what it does well. Take ten minutes this week to go through the apps on your phone, starting with those that hold the most personal information.