Category: Adtech

In December 2021, the Norwegian Data Protection Authority (DPA) issued an administrative fine of NOK 65 million (around EUR 6.5 million) against dating app Grindr for disclosing personal information about users to third parties for behaviour-based marketing without a legal basis.

The decision followed complaints against Grindr and five adtech companies written by None of Your Business (noyb) and filed by the Norwegian Consumer Council (NCC) in January 2020. 

On February 14, 2022, Grindr lodged an appeal against the DPA’s decision, with the appeal being reviewed by the Privacy Appeals Board. DFF funding supported NCC, together with partners noyb, Norwegian law firm Hjort and with assistance from cyber security firm Mnemonic, to ensure that the original decision would be upheld through the appeals process. Meanwhile, NCC continued to follow up on the progress of the complaints against adtech companies Mopub, Xandr, Open X, Smaato and AdColony in the same case complex.

On 29 September 2023, the Norwegian Privacy Appeals Board (Personvernnemnda) announced that it upholds the Norwegian Data Protection Authority’s fine, affirming that Grindr’s practice of sharing sensitive personal data with third parties is illegal.

In October 2026, in response to the 2020 complaints, the Norwegian Data Protection Authority issued a decision against Microsoft adtech company, Xander. The Data Protection Authority ruled that Xander, without a valid legal basis, forwarded personal information about Grindr users in Norway, including about sexual orientation, to potentially thousands of other companies. They issued a record high fine of roughly EUR 8.5 million. The Norwegian Consumer Council states that the decision and fine “sends a powerful signal to anyone who feeds on tracking and profiling consumers. When all actors who access personal data through the digital ad system are responsible for ensuring that the consent is valid, it is difficult to see how today’s monitoring-based marketing system can be legal.“