Norwegian DPA fines Xandr €8.6M for unlawful processing of Grindr users' data

What happened

The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent. Xandr was found to be a joint controller in real‑time bidding, relying on invalid consent from Grindr for sexual orientation data.

Penalty

administrative fine of EUR 8 600 000

Why it matters for trust and compliance

• Its status is decided. The case has an outcome that others may cite.
• The fine highlights the strict liability of joint controllers for obtaining valid consent when handling sensitive personal data.
• Penalty: administrative fine of EUR 8 600 000.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Inventory where this data is shared or sold and whether opt-outs are honoured.
3. Inventory AI or automated decision systems in scope and their assessments.

How this has moved

1. Date not stated · version 1
   Fine · published
   Norwegian Data Protection Authority fines Microsoft’s Xandr €8.5 million for GDPR violations
2. Date not stated · version 2
   Fine · decided