Datatilsynet (Norway) - 20/03541-37
Norway's Datatilsynet fines Xandr NOK 92 million for processing Grindr users' data without valid consent.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Norway's Data Protection Authority (Datatilsynet) has fined Xandr NOK 92,000,000 (approximately €8.5 million) for processing personal data of Grindr users without valid consent. The company, acting as a joint controller, engaged in real-time bidding, processing sensitive data including information about users' sexual orientation. The DPA found violations of GDPR Articles 6(1) and 9(1), citing a lack of valid consent and Xandr's significant influence over the processing means and purposes.
The lesson from this incident
Full lessonXandr, acting as a joint data controller in real-time bidding ecosystems, processed highly sensitive personal data — including users' sexual orientation — without obtaining valid consent under GDPR Articles 6(1) and 9(1). The core failure was the assumption that downstream consent mechanisms were sufficient, without verifying that consent was freely given, specific, informed, and unambiguous as required by law. This case highlights the significant legal liability that arises when companies in advertising supply chains accept and process sensitive data without independently validating the lawful basis for processing. The €8.5 million fine serves as a stark reminder that joint controllers cannot outsource accountability for consent compliance.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.