Norway fines Microsoft ad firm $9.6 million over Grindr data sharing

Xandr, acting as an advertising intermediary, processed and distributed highly sensitive sexual orientation data from Grindr users to thousands of third-party companies without obtaining or verifying explicit user consent — a clear violation of GDPR principles. The root cause lies in a failure to implement proper data governance controls within the advertising supply chain, where sensitive personal data flowed freely without adequate legal basis. This case illustrates how ad-tech ecosystems can become vectors for massive privacy violations, often invisible to the individuals whose data is being exploited. The record fine signals that regulators will hold intermediaries — not just data originators — accountable for unlawful processing, raising the stakes for all participants in digital advertising pipelines.