Norway's Data Protection Authority, Datatilsynet, has fined Xandr, an advertising company owned by Microsoft, NOK 92 million ($9.6 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in Norway.

The authority says this is the largest fine it has ever issued. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal the decision.

"We issued such a high fine in this case because the breaches we identified were very serious," said Line Coll, Director General of Datatilsynet. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."

According to the authority's findings, Xandr ran real-time advertising auctions inside the Grindr dating app between July 2018 and April 2020. Advertisers bid for the right to show an ad to a Grindr user after receiving profiling information from Xandr, which acted as the intermediary. The data exposed through these auctions could include a user's sexual orientation, and it reached thousands of companies.

Datatilsynet found that Xandr was a joint controller with Grindr at the time. That role made Xandr responsible for how the data was used, and it should have required and obtained explicit consent from the people whose data it processed. Instead, Xandr assumed Grindr had collected valid consent and took no steps to check.

"Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated. Sensitive information about Grindr users in Norway and other countries reached advertisers without the users knowing about it or giving explicit consent.

A Microsoft spokesperson said the investigation and its outcome "focused on conduct that predates Microsoft's acquisition of Xandr." Legal frameworks, and the way regulators interpret and enforce them, have changed since then, according to the spokesperson, who added that Microsoft is "reviewing the decision and assessing our options."

The case goes back to a complaint filed in January 2020 by the Austrian privacy group noyb together with the Norwegian Consumer Council (Forbrukerrådet).

Noyb called the decision "a major blow to the online adtech industry" and said that profiling people's interests, habits, location, and behavior requires valid consent, which adtech firms rarely obtain in its view.

For Grindr users, the ruling covers past processing rather than a new setting or change inside the app. The decision applies to auctions run between July 2018 and April 2020, and the authority's findings concern Xandr's failure to verify consent during that period.

Microsoft has not said whether it will appeal before the three-week deadline runs out.