Norway's Datatilsynet announced on October 12 a NOK 92 million administrative fine against advertising company Xandr. The regulator found that it processed Grindr users' personal data, including information revealing sexual orientation, without the required legal basis. Its published decision concerns real-time advertising auctions.
The decision covers July 2018 to April 2020. Datatilsynet says Xandr could not simply assume Grindr had obtained valid consent; each company had its own responsibility. Xandr can appeal within three weeks of receiving the decision. This is a regulatory finding, not a final appeal judgment.
BleepingComputer's October 12 report includes Microsoft's response: the conduct predates its acquisition of Xandr, and the company is reviewing the decision and its options. The case concerns historical advertising-data processing; it should not be presented as a newly discovered breach of today's Grindr systems.