Norway Fines Microsoft Ad Firm 92 Million Kroner Over Grindr Data: The Consent Chain You Never Verified

Norway’s biggest-ever privacy fine lands on a Microsoft ad firm that assumed someone else’s consent was good enough

Datatilsynet, Norway’s data protection authority, has fined Xandr, the advertising business now run as Microsoft Advertising, NOK 92 million (roughly $9.6 million) for unlawfully processing and sharing the sensitive data of Grindr users. The agency called it the largest fine it has ever issued. I read the decision summary twice, because the failure behind the number is not exotic. It is the same assumption buried in most third-party integrations running inside African enterprises today.

What actually happened

Between July 2018 and April 2020, Xandr ran real-time advertising auctions inside Grindr, the location-based dating app serving the LGBTQ+ community. The mechanics are standard adtech. When a user opened the app, Xandr passed profiling information to thousands of advertisers, who bid for the right to show that specific person an ad. In that profiling data sat information from which sexual orientation could be inferred, one of the most sensitive categories any privacy law recognizes.

Users never saw any of this. Thousands of companies got the data anyway.

Xandr acted as a joint controller alongside Grindr during that period, which meant it carried its own responsibility for how the data was used. It should have required explicit consent from users. According to the regulator’s findings, it simply assumed Grindr had obtained valid consent and made no move to verify it. “Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing,” said Line Coll, Director General of Datatilsynet.

“We issued such a high fine in this case because the breaches we identified were very serious,” Coll said. “Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data.”

The complaint trail

This case did not start with a regulator. It started with a complaint filed in January 2020 by NOYB, the Austrian nonprofit privacy organization, together with the Norwegian Consumer Council. Six years of processing later, the decision landed. NOYB called it “a major blow to the online adtech industry,” aimed at the covert exchange of sensitive data between websites, apps, platforms, and operating systems that the industry has treated as normal operations for two decades.

“Profiling people’s interests, habits, location, and behavior requires valid consent, which adtech companies hardly ever obtain,” NOYB said.

Microsoft has three weeks to appeal. A spokesperson told BleepingComputer the investigation “focused on conduct that predates Microsoft’s acquisition of Xandr,” and that the company is reviewing the decision and assessing its options. Legally defensible, and beside the point. When you buy an ad platform you inherit its data relationships. If due diligence missed how a partner sourced consent, the bill is still yours when the regulator arrives.

Why this should worry every CISO on the continent

Skip the GDPR statute names and the story repeats under POPIA. The Act makes a responsible party liable for lawful processing, and its operator provisions push that accountability down the contractor chain: outsourcing the data handling does not outsource the obligation. A fintech running programmatic ads through a demand-side platform, a bank embedding an analytics SDK, a retailer wiring in a personalization vendor, all of them are in Xandr’s position right now. Someone upstream collected the data. Your systems process it. Whose consent are you relying on, and when did anyone last verify it?

Most enterprises have no answer. Procurement signed the vendor. Marketing turned on the integration. Security never saw the data contract. And the auction traffic is invisible to conventional defenses, because it rides legitimate HTTPS to a legitimate domain, sanctioned by the business, leaving the building one request at a time. A WAF does not care. A DLP rule watching for sensitive keywords does not fire on a bid request full of device identifiers and coarse location.

What to do about it

• Map the exit paths. Every SDK, pixel, tag manager, and ad integration in your apps and web properties is a data egress route. Inventory them against what actually leaves, not what the vendor fact sheet promises.
• Paper the consent chain. If you process third-party-sourced personal data, get written evidence of the lawful basis, not a checkbox buried in a master services agreement. An assumption of valid consent is exactly what cost Xandr 92 million kroner.
• Watch the wire, not just the perimeter. The eHawu network layer inspects outbound traffic continuously and flags beaconing to adtech and analytics endpoints, including the request shapes that carry identifiers and location. You cannot defend a consent chain you never monitored.
• Treat other regulators’ histories as a leading indicator. Norway’s largest-ever fine traces back to a 2020 complaint. Regulators here are younger, but the complaint mechanism works the same way, and on the same slow clock. The enforcement wave is coming. The date is the only unknown.

eHawu gives African enterprises visibility into exactly the traffic class this case turned on: quiet, contract-sanctioned sharing of sensitive data that never looks like an attack. The fine in Oslo is someone else’s headline today. The exposure in your own app is yours.

Tags: #PrivacyEnforcement, #POPIA, #AdTech, #DataGovernance, #ThirdPartyRisk, #EnterpriseSecurity