The Norwegian Data Protection Authority has fined the advertising technology company Xandr, a Microsoft subsidiary, for GDPR violations related to the processing of data from the Grindr dating app.

Following a complaint filed in 2020 by the association `noyb` and the Norwegian Consumer Council (NCC), the authority concluded that Xandr processed personal data, including sensitive information related to sexual orientation, without a valid legal basis. This practice was part of a system where apps transmit personal data to numerous partners via tracking identifiers to build detailed profiles for advertising purposes. Consequently, a fine of 92,000,000 NOK (approximately 8,500,000 €) was imposed on the company.

Furthermore, a proposal from the European Commission, known as the "Digital Omnibus," is under review. It aims to exclude online tracking identifiers from the scope of the GDPR. This amendment, which would follow lobbying by tech companies, could legalize mass profiling practices and limit the liability of sector actors for violations related to these identifiers. The proposal is currently being examined by the European Parliament and the Council.