All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Norway’s data protection regulator has penalized advertising business Xandr $9.6 million for illegally exchanging data connected to Grindr users with possibly thousands of marketers.[1]
The case shows how merely utilizing a dating app can reveal deeply personal information, including your sexual orientation. You may never see which companies receive this data or realize how they use it.
Norway’s Data Protection Authority has fined Xandr 92 million Norwegian kroner, about US$9.6 million, its largest penalty to date. Between July 2018 and April 2020, Xandr shared Grindr users’ data with potentially thousands of companies through automated ad auctions.
Using Grindr can indicate someone’s sexual orientation, which receives special protection under European GDPR privacy laws. The regulator fined Grindr 65 million kroner in 2021 over the same breaches. This penalty targets the advertising middleman.
Xandr said it assumed Grindr had obtained users’ consent. Regulators rejected that defense, finding that Xandr shared responsibility for ensuring the consent was valid.
Microsoft acquired Xandr in June 2022, after the violations occurred, so regulators calculated the fine using Xandr’s revenue. Microsoft said privacy is a priority and that it is reviewing the decision.
Apps often use advertising software called SDKs to display ads and earn money. Ad tech companies can auction off that ad space in a process called real-time bidding (RTB).
Before an ad appears, a “bid request” goes to potential advertisers. It may include your phone’s advertising ID, location, IP address, and the app you’re using.
Ad exchanges such as Xandr distribute these requests to bidders. That means companies may receive information about you even if they don’t win the auction or show you an ad.
A 2025 hack of location data broker Gravy Analytics exposed records naming thousands of apps that may have supplied its data. Many developers said they had no relationship with the company, highlighting how advertising systems can share users’ location without developers realizing it.
An August EFF report also identified advertising SDKs that collect and share location data by default when an app has location permission.
Ad data doesn’t need your name to help identify you. Location history can connect a device to your home, workplace, and daily routines.
In July 2021, Catholic news outlet The Pillar said it used commercially available app data to link Monsignor Jeffrey Burrill to Grindr use and visits to gay bars. It identified his device by matching its movements to places where he lived, worked, and traveled. Burrill resigned before the report was published.
Since the data shared through Grindr comes from an app associated with LGBTQIA+ dating, it may reveal a person’s sexual orientation without explicitly stating it. This creates several privacy concerns, including the possibility of outing someone without their consent.
Here are a few settings you can adjust to improve your phone’s privacy and limit how much personal data apps and advertisers can collect.
Restricting access to your advertising ID or deleting it makes it harder for apps and ad companies to link your activity across different apps and websites. You’ll still see ads, but they may be less targeted.
On your iPhone, go to Settings > Privacy & Security > Tracking, then turn off Allow Apps to Request to Track. This limits apps’ ability to access your advertising identifier for tracking through Apple’s tracking-permission system.
On Android, go to Settings > Security & Privacy > Privacy Controls > Ads, then select Delete Advertising ID.
Check which apps can access your location. On your iPhone, go to Settings > Privacy & Security > Location Services. Review the list of apps and revoke location access if it isn’t essential to their functions, such as for a basic calculator or flashlight app.
You can also select While Using the App to limit location access to when you’re actively using an app. Under the same settings page, you’ll find a toggle for Precise Location. Turning it off lets an app access your approximate location instead of your precise location.
On Android, go to Settings > Location to review which apps can access your location. You can turn off location services altogether or adjust permissions for individual apps.
When combined with information from data breaches or other sources, it can help companies or malicious actors build a detailed profile of you and target you with phishing or financial fraud attempts. In some cases, personal data may also end up for sale on the dark web.
An identity theft protection service may help you monitor for exposed personal information. These services can scan known breach databases and the dark web for your details and alert you when they find a match.
Xandr has been fined $9.6 million for unlawfully sharing sensitive data linked to Grindr users with advertisers. This could help identify someone’s home, workplace, and regular hangouts, potentially exposing them to outing, discrimination, or doxxing.
Cybercriminals could also combine it with data from other sources to launch phishing attacks or commit financial fraud.
To reduce cross-app tracking and limit the data advertisers can collect, restrict apps’ access to your advertising ID on iPhone or delete the ID on Android. Additionally, review location permissions and limit access to apps that genuinely need it.
Credit monitoring service with 3-bureau scores updated monthly and a breakdown of what's affecting your score
Data removal covers 425+ broker sites, plus a digital account cleanup that flags risky accounts in your inbox
Identity theft insurance up to $1M for individuals, with 24/7 phone and email support
/images/2023/12/01/omniwatch_review.jpg)
/images/2023/06/01/incogni-review.png)
/images/2026/10/14/norway_fines_xandr_9.6_million_for_sharing_grindr_users_sensitive_data.png)
/images/2026/10/12/police_do_not_cross_tape_at_night_in_downtown_philadelphia.jpg)
/images/2026/10/09/age-verification-checks-survey.png)
/images/2026/10/08/claude-chat-arrest-florida-woman.jpeg)
/images/2026/10/08/california-sb-690-online-tracking-lawsuits.png){kind=tracking}
/images/2026/10/07/trump-mobile-data-breach.jpeg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/thomas-kent-headshot-cropped.png){kind=small}
/images/2024/05/17/7249df62-b35e-4ac5-bfc4-0e28a6a30b9e.png)
/authors/krishi_chowdhary_headshot.jpg)