Norway's data protection authority on Monday slapped a 92 million kroner (8.6 million euro) fine on Microsoft subsidiary Xandr for sharing user-data from dating app Grindr.
Xandr, an online advertising company, is accused of processing and then transmitting data from Grindr users to a real-time advertising bidding system, where it may have been shared with potentially thousands of companies to enable them to display targeted ads.
Datatilsynet said thousands of Norwegian users of the app had been affected after information that could reveal their sexual orientation was passed on to advertisers without their explicit consent.
"The violations in this case are very serious," said Datatilsynet chief Line Coll.
"Responsibility for data protection cannot be delegated to others. Each company must itself ensure, and be able to prove, that it is authorised to use this data."
Xandr said it believed Grindr had previously obtained its users' consent.
The violations occurred between July 2018 and April 2020 before the firm was bought by Microsoft.
The company has three weeks to appeal.
The Norwegian courts in 2025 upheld a Datatilsynet fine of 65 million kroner on Grindr for unlawfully sharing sensitive data.