Xandr, a Microsoft subsidiary, has been accused of sharing user data from the dating app Grindr and fined 92 million Norwegian kroner by Norway’s data protection authority.

Xandr, a digital advertising company, is alleged to have collected and transferred Grindr users’ data to a real-time ad-bidding platform. This information may subsequently have been made available to thousands of companies to deliver targeted advertisements.

According to Norway’s data protection authority, Datatilsynet, thousands of Norwegian Grindr users were affected after information that could reveal their sexual orientation was shared with advertisers without their explicit consent.

Datatilsynet chief Line Coll said: “The violations in this case are very serious,” adding that “responsibility for data protection cannot be delegated to others. Each company must itself ensure, and be able to prove, that it is authorised to use this data.”

Datatilsynet noted that the alleged data transfers took place between July 2018 and April 2020, before Xandr was acquired by Microsoft. Xandr has three weeks to appeal the decision.