[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fthBJ3awXbC8CMeOXxSvK7W7DPSw8ob45BAxCFL3D-60":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":119},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"8a26ce98-21bf-4d28-b6c7-ca19e28ffab6","Datatilsynet (Norway) - 20\u002F03541-37","datatilsynet-norway-20-03541-37-2b19d2","← Older revision Revision as of 13:41, 13 October 2026 Line 112: Line 112: }} }} The DPA fined Xandr NOK 92,000,000 (€8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. The DPA fined Xandr NOK 92 m (€8.5 m) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. == English Summary == == English Summary == Line 150: Line 150: When it comes to the legal basis of [[Article 6 GDPR|Article 6(1) GDPR]] when processing personal data of Grindr users, since the consent that Grindr collected was invalid and Xandr did not provide sufficient information as to the legal basis, no legal basis was applicable. Therefore, the DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]]. When it comes to the legal basis of [[Article 6 GDPR|Article 6(1) GDPR]] when processing personal data of Grindr users, since the consent that Grindr collected was invalid and Xandr did not provide sufficient information as to the legal basis, no legal basis was applicable. Therefore, the DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]]. The DPA fined Xandr NOK 92,000,000 (€ 8,500,000). When it comes to the reasons for issuing the fine, the DPA argued that with [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR]], Xandr violated core data protection rights of individuals and basic requirements for processing personal data. The intransparency of the AdTech ecosystem was found an aggravating factor. Moreover, the data subjects did not initiate the processing and did not intend to share their personal data with Xandr and its 4,000 advertising partners for commercial purposes. The nature of the personal data affected, namely data on sexual orientation, was taken into account as well as the fact that Xandr financially benefitted from the unlawful processing. The DPA fined Xandr NOK 92 m (€8.5 m). When it comes to the reasons for issuing the fine, the DPA argued that with [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR]], Xandr violated core data protection rights of individuals and basic requirements for processing personal data. The intransparency of the AdTech ecosystem was found an aggravating factor. Moreover, the data subjects did not initiate the processing and did not intend to share their personal data with Xandr and its 4,000 advertising partners for commercial purposes. The nature of the personal data affected, namely data on sexual orientation, was taken into account as well as the fact that Xandr financially benefitted from the unlawful processing. The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect. The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect.","Datatilsynet (Norway's Data Protection Authority) issued an €8.5 million fine against Xandr for unlawfully processing personal data of Grindr users, including sensitive data on sexual orientation, without valid consent during real-time bidding activities. Xandr acted as a joint controller alongside 4,000 advertising partners and violated Articles 6(1) and 9 GDPR. The DPA cited the opacity of the AdTech ecosystem and Xandr's financial gain as aggravating factors, rejecting the argument that the practice was standard in the industry.","Norway DPA fines Xandr €8.5M for processing Grindr users' sexual orientation data without valid consent in real-time","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53387&oldid=53382","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-10-13T13:41:47+00:00","2026-10-13T14:00:14.053161+00:00",8,[17,20,23],{"name":18,"type":19},"Xandr","vendor",{"name":21,"type":22},"Grindr","product",{"name":24,"type":25},"Real-time bidding (RTB)","technology","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":26,"icon":28,"name":29,"slug":30},null,"GDPR","gdpr",[32,37],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":45,"vendors":118},[46,72,101],{"slug":47,"name":48,"problem":49,"products":50},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[51,58,66],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":53,"url":56,"description":57},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":67,"product_name":68,"url":70,"description":71},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":73,"name":74,"problem":75,"products":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":102,"name":103,"problem":104,"products":105},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[106,112],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":107,"product_name":108,"url":110,"description":111},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":120,"title":121,"body":122,"framework_refs":123,"framework_notes":135},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","Xandr, operating as a joint controller within the opaque AdTech real-time bidding ecosystem, processed sensitive personal data — including sexual orientation — of Grindr users without a valid legal basis, violating GDPR Articles 6(1) and 9. The root failure was a systemic disregard for lawful consent mechanisms, compounded by the complexity of a supply chain involving over 4,000 advertising partners who collectively amplified the exposure of sensitive data. This case underscores that 'industry standard practice' is not a legal defence under GDPR, particularly when processing special category data. The financial gain derived from the unlawful processing was treated as an aggravating factor, signalling that regulators will scrutinise the economic incentives behind data misuse. Organisations must understand that participating in programmatic advertising ecosystems creates joint controllership obligations that cannot be delegated away.",[124,125,126,127,128,129,130,131,132,133,134],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 26 — Joint controllers","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.CO-P3 — Data processing consent","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","NIST SP 800-53 PT-5 — Privacy Notice","CIS Control 3 — Data Protection","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management (PIMS)","ITIL Service Design — Third-party and supplier management",{}]