Norway’s data protection authority has fined Xandr, Microsoft’s advertising unit, €8.6 million for unlawfully relaying sensitive data linked to Grindr users to advertisers. According to the authority, the shared data could reveal users’ sexual orientation, making the case particularly serious under European privacy rules.

For European businesses, the decision is another clear signal that adtech practices involving profiling, real-time bidding, consent collection and third-party data sharing remain under close regulatory scrutiny. It is especially relevant for companies that rely on advertising platforms, tracking technologies and external data partners.

What happened

According to the reported decision, the Norwegian Data Protection Authority concluded that Xandr illegally relayed Grindr users’ sensitive personal data to advertisers. The authority said the data could reveal sexual orientation, which is treated as a special category of personal data under the GDPR and is subject to stricter protections.

The regulator reportedly described the infringement as very serious and issued what was described as its largest administrative fine to date. Based on the source report, the case concerns the handling and onward sharing of advertising data rather than a conventional cyberattack or data breach caused by external attackers.

While the source summarises the enforcement outcome, businesses should note an important distinction: a regulator’s decision concerns the facts and legal analysis in that case. It does not automatically mean that every adtech data-sharing model is unlawful, but it does show the level of risk where sensitive data can be inferred, shared or used for advertising purposes without a valid legal basis.

Why it matters for European businesses

This case matters beyond one platform because it highlights a core compliance problem in digital advertising: data that appears technical or pseudonymous can still become highly sensitive when combined with app context, user behaviour or audience targeting signals.

For businesses operating in Europe, the practical issue is not limited to dating apps. Any company using advertising technology may be exposed if its marketing stack involves:

• sharing user data with multiple adtech vendors
• profiling users for targeting or measurement
• using consent banners that do not clearly cover downstream data use
• combining app, website or location signals that may reveal sensitive characteristics
• relying on third-party audiences or data brokers without strong due diligence

Under the GDPR, special category data such as information revealing sex life or sexual orientation requires stronger legal protections. Even where a company does not intentionally label a person by a sensitive trait, regulators may look at whether the processing context effectively reveals it.

The decision is also commercially relevant for marketing teams. European companies are under growing pressure to reassess whether audience targeting and programmatic advertising setups can be justified from both a compliance and brand-risk perspective. A privacy failure involving sensitive data can create legal exposure, vendor risk and reputational damage at the same time.

Who may be affected

The immediate impact is strongest for organisations involved in digital advertising and data-driven marketing, including:

• advertisers and brands using third-party ad networks, audience targeting or behavioural profiling
• publishers and app operators that pass user data into advertising exchanges or measurement ecosystems
• martech and adtech teams managing consent frameworks, trackers, customer data flows and media buying platforms
• e-commerce businesses that use external platforms for retargeting, attribution and personalised advertising
• regulated or privacy-sensitive businesses handling health, relationship, location or other data that could reveal intimate or protected characteristics

IT, legal and procurement teams may also be affected because vendor contracts, data processing arrangements and tracking configurations often determine how far user data travels across the advertising supply chain.

What companies should consider

Businesses do not need to stop all digital advertising, but they should review whether their current practices create avoidable GDPR risk.

• Map adtech data flows: identify which platforms, exchanges, SDKs, pixels and partners receive website or app data.
• Check for sensitive-data exposure: assess whether page context, app type, audience segment or event data could reveal health, religion, sexual orientation, political views or other special category information.
• Review consent mechanisms: make sure consent language is specific enough to cover advertising, profiling and third-party sharing where required.
• Reassess vendor due diligence: ask advertising and measurement partners what data they receive, how they use it, whether they combine it with other sources and what legal basis they rely on.
• Limit unnecessary sharing: reduce the number of external parties receiving user-level data where possible.
• Consider privacy-first alternatives: use contextual advertising, first-party data strategies and aggregated measurement where these better fit the risk profile.
• Involve legal and technical teams together: privacy compliance in advertising is not only a legal wording issue; it depends on how tags, SDKs and integrations actually work in production.

For SMEs, the key lesson is practical: if your business uses external advertising technology, you may still carry compliance risk even when a vendor operates the platform. European regulators continue to examine how personal data moves through digital advertising systems, particularly where sensitive information may be inferred or disclosed.