The Norwegian Data Protection Authority's decision to impose a record €8.6 million fine on Xandr, the advertising technology business subsequently acquired by Microsoft, highlights an important reality of modern cybersecurity: personal information can be exposed not only through cyberattacks and data breaches, but also through the way organizations legitimately collect, process and distribute data.

The case concerns Xandr's involvement in the sharing of sensitive personal information belonging to Grindr users in Norway between July 2018 and April 2020. According to the regulator, the company acted as an intermediary in the real-time bidding advertising ecosystem, transmitting information that could reveal users' sexual orientation to potentially thousands of other companies without establishing a valid legal basis for processing that information.

What makes this case particularly concerning is that the data was not necessarily stolen by cybercriminals or exposed through a software vulnerability. Instead, it was distributed through established advertising technology infrastructure as part of routine commercial operations.

Real-time bidding allows advertisers to compete for opportunities to display advertisements to individual users. However, the underlying process can involve distributing information about users to multiple participants within milliseconds, often without individuals understanding how widely their personal information is being shared.

The central issue in this case was accountability. Xandr reportedly relied on the assumption that Grindr had already obtained appropriate user consent. The Norwegian regulator rejected this approach, determining that Xandr was a joint controller and therefore had its own responsibility to establish a lawful basis for processing the data.

This distinction is significant for every organization participating in a complex digital ecosystem. Data protection responsibilities cannot simply be transferred to another company through commercial agreements or assumptions about consent.

Organizations collecting or processing personal information must understand where that information originates, why it is collected, which third parties receive it and whether the processing is genuinely authorized.

The incident also demonstrates why privacy protection must extend beyond traditional cybersecurity measures. Firewalls, intrusion prevention systems and malware detection technologies are essential for defending against unauthorized access, but they cannot independently determine whether every business-approved transfer of personal data complies with privacy regulations.

Effective protection requires a combination of technical controls and organizational governance, including data classification, data minimization, purpose limitation, third-party risk assessments, consent management, data flow monitoring and appropriate data loss prevention policies.

Particularly sensitive personal information deserves stronger safeguards because unauthorized disclosure can expose individuals to discrimination, harassment and other serious personal consequences.

The broader lesson is that data privacy is not achieved merely by preventing outsiders from stealing information. It also requires ensuring that organizations themselves do not collect, use or distribute personal data beyond what individuals have knowingly and lawfully authorized.

A company can have sophisticated cybersecurity defenses and still fail to protect privacy if its legitimate business processes expose sensitive information without adequate safeguards.

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements

Source: Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation via The Hacker News — published 13 Oct 2026.