Norway fines Microsoft-owned Xandr 92 million crowns over Grindr users' data shared with advertisers

Datatilsynet's reasoning fits in one sentence. "Responsibility for data protection cannot be delegated to others," Director General Line Coll said in the authority's statement, as quoted by Tech Xplore ^[10]. According to Cryptopolitan's account, she added that each company must independently ensure, and be able to demonstrate, that it has a legal basis for the data it procures ^[11]. The authority describes real-time bidding as a sale of ad space in milliseconds as a user opens an app, with the user's data potentially reaching thousands of companies ^[12]. We think a legal basis that has to be demonstrable for each of those recipients cannot be assembled by hand at that speed, so the working consequence is a consent check inside the bidder's own systems.

Microsoft's answer rests on timing. "This investigation and decision focused on conduct that predates Microsoft's acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing the decision and assessing our options," Microsoft said ^[15]. The evolving-standards point has two rulings against it, though neither involved Xandr. Norwegian courts upheld the 65 million crown fine on Grindr in 2025 ^[9], and the Conseil d'Etat upheld a 40 million euro fine on Criteo earlier in 2026, rejecting Criteo's claim that partner websites were responsible for collecting consent ^[22]. A Norwegian appeal body has not ruled on Xandr. A reversal of the shared-responsibility finding would undo our reading for Norway, and a payment with no appeal would leave the finding standing.

Against the $3.97 trillion GuruFocus puts on Microsoft ^[20], $9.61 million is roughly 0.00024 percent ^[21], or rather 0.00024 percent of a valuation Cryptopolitan took from a single data site. For a bidder the more useful unit is time: 92 million crowns over roughly 21 months of conduct is about 4.4 million crowns, or $458,000, a month ^[19]. That unit is crude, because the authority also weighed Xandr's direct financial benefit from the sharing ^[13]. The sources do not put a cost on verifying consent, so whether $458,000 a month is cheap stays unresolved.