Datatilsynet (Norway) - 20/03541-37

Xandr, operating as a joint controller within the opaque AdTech real-time bidding ecosystem, processed sensitive personal data — including sexual orientation — of Grindr users without a valid legal basis, violating GDPR Articles 6(1) and 9. The root failure was a systemic disregard for lawful consent mechanisms, compounded by the complexity of a supply chain involving over 4,000 advertising partners who collectively amplified the exposure of sensitive data. This case underscores that 'industry standard practice' is not a legal defence under GDPR, particularly when processing special category data. The financial gain derived from the unlawful processing was treated as an aggravating factor, signalling that regulators will scrutinise the economic incentives behind data misuse. Organisations must understand that participating in programmatic advertising ecosystems creates joint controllership obligations that cannot be delegated away.