by Gabriel Avigdor

In short. Norway has fined Xandr, Microsoft’s advertising company, NOK 92 million (about €8.5 million). Xandr used data from the dating app Grindr, including users’ sexual orientation, without a valid legal basis. Xandr used to be called AppNexus. I wrote about the complaint against it in 2020. This is how that story ends.

Back to 2020

In January 2020 I wrote a long piece on a report by the Norwegian Consumer Council called “Out of Control”. The report showed how free apps send personal data to dozens of advertising firms. Most users have never heard of these firms.

The Council filed three complaints in Oslo. The first one targeted Grindr, Twitter’s MoPub, OpenX and a company called AppNexus. AppNexus was later bought by AT&T, then by Microsoft, and renamed Xandr. So the decision of 12 October 2026 closes complaint number one.

Grindr was fined first, back in 2021. It appealed and lost. Now it is the turn of a company that received the data.

Why this decision matters

€8.5 million is small change for Microsoft. The amount is not the point. The target is.

Until now, regulators mostly went after the app that leaked the data. This time they followed the data down the chain. They reached the hidden middleman, the company users never dealt with directly.

How does the data travel? Through SDKs. An SDK (software development kit) is a ready-made piece of code that an app developer plugs into an app. Advertising SDKs are offered free by adtech firms. In exchange, they collect data each time the app opens: device identifiers, location, the name of the app. That data is then auctioned in milliseconds to advertisers. This is called real-time bidding. I explained the mechanics, and the people involved, in my 2020 article. The UK regulator also published a useful report on real-time bidding.

The Norwegian message is simple. “If you use the data for your own purposes, you need your own legal basis. You cannot rely on consent that someone else claims to have collected.” And when the data is sensitive, as sexual orientation is under Article 9 GDPR, you need explicit consent. Real-time bidding has never really been able to provide that. My article on cookie banners shows how hard valid consent is to get, even on a simple website.

Part of a clear trend

The Norwegian decision is not isolated. European courts and regulators have been moving in the same direction:

• In IAB Europe (C-604/22), decided in March 2024, the EU Court of Justice held that the consent signal used across the adtech industry is personal data. The organisation that designed the system can be a joint controller under Article 26 GDPR.
• In Schrems v Meta (C-446/21), decided in October 2024, the Court said Meta cannot use all personal data for ads without limits. It also said that talking publicly about your sexual orientation does not give advertisers a free pass to use it.
• In France, the Conseil d’État upheld a €40 million fine against the adtech company Criteo.

The common thread: in adtech, not knowing where the data goes is no excuse.

What about Switzerland?

In 2020 I regretted that the Swiss regulator could only make recommendations. I also noted that the revised law would bring personal criminal fines of up to CHF 250,000, but no fines for companies. That is exactly what happened. The revised Federal Act on Data Protection (FADP) has applied since September 2023.

The rules themselves are now stronger. Sexual orientation is sensitive data (Art. 5(c) FADP). Building detailed interest profiles is very likely “high-risk profiling” (Art. 5(g)). Where consent is needed, it must then be express (Art. 6(7)). The Swiss Commissioner (FDPIC) can now also issue binding decisions.

So no Norwegian-style company fines. But the person in charge can be fined personally, which is not exactly more comfortable. And a Swiss company that targets users in the EU is subject to the GDPR anyway (Art. 3(2) GDPR).

Strange timing

The decision comes at an odd moment. Through its “Digital Omnibus” package, the European Commission has proposed changes to the GDPR. One idea would narrow the definition of personal data. Critics such as noyb say tracking IDs could then fall outside the GDPR. In other words, Oslo is fining what Brussels might make harder to fine.

The proposal is still being debated by the European Parliament and the Council. I will not take sides here. My practical advice is simple: do not build your compliance on a law that has not been adopted. And sensitive data would remain protected in any case.

Key takeaways

• Every company in the advertising chain needs its own legal basis.
• Data that indirectly reveals something sensitive (the app you use, a place you visit) is treated as sensitive.
• Health, wellbeing and dating apps should audit their advertising SDKs and data flows now.
• In Switzerland, high-risk profiling and sensitive data require express consent. Liability is personal.

In 2020 I wrote that time would tell whether privacy law could change online advertising. It took six years to get a first answer. In data protection, that is almost fast.

Sources: noyb, 12 October 2026; Norwegian Data Protection Authority; Norwegian Consumer Council, Out of Control. Photo: Daniel Bertrams / Unsplash.

Gabriel Avigdor | gabriel.avigdor@datalex.ch