[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fm3Eit-Tsgmaqjg5i-NYYj3E1O8S7gI7zhUtHkjKDgt0":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":104},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"d76ceb3d-4970-4c22-9c5f-a173ce82a140","Datatilsynet (Norway) - 20\u002F03541-37","datatilsynet-norway-20-03541-37-607b9e","Created page with \"{{DPAdecisionBOX |Jurisdiction=Norway |DPA-BG-Color= |DPAlogo=LogoNO.png |DPA_Abbrevation=Datatilsynet |DPA_With_Country=Datatilsynet (Norway) |Case_Number_Name=20\u002F03541-37 |ECLI= |Original_Source_Name_1=Datatilsynet |Original_Source_Link_1=https:\u002F\u002Fwww.datatilsynet.no\u002Faktuelt\u002Faktuelle-nyheter-2026\u002Fdatatilsynet-gir-microsoft-selskap-92-millioner-i-bot\u002F |Original_Source_Language_1=Norwegian |Original_Source_Language__Code_1=NO |Original_Source_Name_2= |Original_Sourc...\" New page {{DPAdecisionBOX |Jurisdiction=Norway |DPA-BG-Color= |DPAlogo=LogoNO.png |DPA_Abbrevation=Datatilsynet |DPA_With_Country=Datatilsynet (Norway) |Case_Number_Name=20\u002F03541-37 |ECLI= |Original_Source_Name_1=Datatilsynet |Original_Source_Link_1=https:\u002F\u002Fwww.datatilsynet.no\u002Faktuelt\u002Faktuelle-nyheter-2026\u002Fdatatilsynet-gir-microsoft-selskap-92-millioner-i-bot\u002F |Original_Source_Language_1=Norwegian |Original_Source_Language__Code_1=NO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome= |Date_Started= |Date_Decided=02.10.2026 |Date_Published= |Year=2026 |Fine=92000000.0 |Currency=NOK |GDPR_Article_1=Article 4(11) GDPR |GDPR_Article_Link_1=Article 4 GDPR#11 |GDPR_Article_2=Article 5(2) GDPR |GDPR_Article_Link_2=Article 5 GDPR#2 |GDPR_Article_3=Article 6(1)(a) GDPR |GDPR_Article_Link_3=Article 6 GDPR#1a |GDPR_Article_4=Article 7 GDPR |GDPR_Article_Link_4=Article 7 GDPR |GDPR_Article_5=Article 9(1) GDPR |GDPR_Article_Link_5=Article 9 GDPR#1 |GDPR_Article_6=Article 9(2) GDPR |GDPR_Article_Link_6=Article 9 GDPR#2 |GDPR_Article_7=Article 24 GDPR |GDPR_Article_Link_7=Article 24 GDPR |GDPR_Article_8=Article 26(1) GDPR |GDPR_Article_Link_8=Article 26 GDPR#1 |GDPR_Article_9=Article 83(5)(a) GDPR |GDPR_Article_Link_9=Article 83 GDPR#5a |GDPR_Article_10= |GDPR_Article_Link_10= |GDPR_Article_11= |GDPR_Article_Link_11= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=lh | }} The DPA fined Xandr NOK 92,000,000 (€ 8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. == English Summary == === Facts === The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where the clients were able to conduct, optimize and track their advertising transactions. Through the platform, Xandr receives ad requests of their clients and enriches the bid with information which segment(s) a user belongs to. The bid request is sent to advertisers who evaluate the request and decide whether to bid on the ad space. Real-time bidding requires the collection, accumulation and dissemination of personal data to target and personalise the advertisement and optimise the bid. The console offers settings where the clients of Xandr can exclude certain categories of data from bid requests or to exclude certain recipients from receiving bid requests. Within this process of real-time bidding at hand, Xandr processed personal data of Grindr users in Norway. Grindr is a dating app with a target market in the LGBTQ+ community. Amongst the data processed by Xandr was the information that individuals were using Grindr, their advertising ID, and IP addresses. This data was shared with third-party advertisers. On the one side, Xandr provided assistance to Grindr to make its ad spaces available to potential buyers. On the other side, Xandr also operated on the demand side and send ad requests to third parties where an ad should be placed on the Grindr app, through an intermediary that had access controls within the console. The Norwegian Consumer Council lodged a complaint with the DPA on the basis of [[Article 80 GDPR|Article 80(1) GDPR]]. An additional complaint was filed regarding GDPR violations by Grindr. === Holding === The DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR|Article 9(1) GDPR]]. The DPA held that the personal data processed (app name, app ID and app URL) were personal data pursuant to [[Article 4 GDPR|Article 4(1) GDPR]]. This is true for online identifiers that can make a natural person identifiable. As far as the role of Xandr as controller was concerned, the DPA held that Xandr acted as joint controller pursuant to [[Article 26 GDPR|Article 26(1) GDPR]] because it made decisions on the purposes and means of processing. While a processor may make certain decisions on the purposes and means, decisions of essential means are reserved to the controller. Joint controllership is assumed when the processing would not be possible without both parties’ participation in the purposes and means. When Xandr acted as advertiser and its platform placed ad buying bids to display ads on the Grindr app, it acted as joint controller with Grindr. In this process, ad buyers select a “segment” for a particular ad campaign. Xandr made available standard segments that the ad buyers could chose from. Therefore, according to the DPA, Xandr influenced the processing. When Xandr’s platform processed ad delivery and bid requests originating from Grindr, it acted partly as controller and partly as processor. Xandr maintained that it assumed the role of processor of Grindr, which is an assessment that is not supported by Grindr. The DPA considered that Xandr pursued its own objective of being a facilitator of exchanges between publishers and advertisers that involves data processing on its multi-sided platform. It was Xandr that defined the infrastructure and constraints for those exchanges. Xandr had an interest both when it came to the number of participants in that exchange system as well as when providing precise marketing and maximising value for advertisers and publishers were concerned. An aspect of that was the procedure of enrichening ad requests for ad spaces on the side of Xandr, which benefits Xandr and Grindr likewise. While Grindr was able to control categories of data contained in bid requests as well as the recipients thereof through the console offered by Xandr, it was on Xandr’s side to provide the framework for exercising such control, for example by deciding what advertisers Grindr was able to interact with. In case Grindr did not make any selections within the console, the standard settings decided on by Xandr would apply and the bid request would be circulated to the recipients that Xandr included on its platform. By providing the framework and offering its service on the console with the standard selected by Xandr, Xandr had a tangible impact on the determination of the purposes and means of processing. Moreover, Xandr could instruct Grindr on the categories of data shared with it. The DPA recurred to the broad understanding of the concept of “controller” according to CJEU case law and took into consideration the opaque practices in the AdTech industry where a large number of companies exchange personal data along complex value chains. It is unlikely in this ecosystem that one actor alone fully controls how the data is processed. According to the DPA, a failure to hold these companies accountable would result in diffusion or elimination of responsibility, also with regard to data subjects’ rights. This would run counter the objective of the GDPR to ensure a high level of data protection. The fact that neither Xandr nor Grindr accepted controllership would result in an evasion of responsibility to answer to data subjects’ rights. However, the notion of controller is a functional concept that is determined by factual circumstances and not by contractual agreements. Since both Xandr and Grindr pursued their respective interests and purposes when processing the personal data, they both exercised decisive influence on the decision on the means of processing. The processing could not have taken place without the contribution of both parties in deciding the purposes and means, making them joint controllers. While joint controllers may distribute tasks and divide responsibility pursuant to [[Article 26 GDPR|Article 26(1) GDPR]], the accountability principle ([[Article 5 GDPR|Article 5(2) GDPR]]) as well as the obligations under [[Article 24 GDPR|Article 24 GDPR]] apply to both controllers. Compliance cannot be outsourced and both controllers are responsible and must demonstrate compliance with the GDPR, for example when it comes to determining a legal basis for the processing. The DPA found that Xandr processed special categories of personal data pursuant to [[Article 9 GDPR|Article 9(1) GDPR]]. The information that a person is being registered on Grindr is to be considered information about someone’s sexual orientation. In the separate Grindr case before the DPA, the DPA found that the information that data subjects were Grindr users was not “manifestly made public” by the data subjects pursuant to [[Article 9 GDPR|Article 9(2)(e) GDPR]]. Xandr could also not rely on explicit consent pursuant to [[Article 9 GDPR|Article 9(2)(a) GDPR]]. It never obtained the consent directly from the data subjects itself. The consent that Grindr obtained from its users did not fulfil the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR|Article 7 GDPR]]. Therefore, it was invalid. Both joint controllers must have a valid legal basis for the processing. The fact that Grindr was responsible for collecting the data subjects’ consent did not exempt Xandr from its accountability obligations under [[Article 5 GDPR|Article 5(2) GDPR]] and [[Article 24 GDPR|Article 24 GDPR]]. Despite the fact that it is possible to contractually oblige one joint controller to collect consent on behalf of the other, the other controller must ensure that the consent meets the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR|Article 7 GDPR]]. Since the data at hand concerned special categories of data, Xandr was not able to discharge of its accountability obligations simply by contractual agreement. It did not take any additional measures to ensure that the consent given was lawful. Therefore, Xandr breached [[Article 9 GDPR|Article 9(1) GDPR]]. When it comes to the legal basis of [[Article 6 GDPR|Article 6(1) GDPR]] when processing personal data of Grindr users, since the consent that Grindr collected was invalid and Xandr did not provide sufficient information as to the legal basis, no legal basis was applicable. Therefore, the DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]]. The DPA fined Xandr NOK 92,000,000 (€ 8,500,000). When it comes to the reasons for issuing the fine, the DPA argued that with [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR|Article 9 GDPR]], Xandr violated core data protection rights of individuals and basic requirements for processing personal data. The intransparency of the AdTech ecosystem was found an aggravating factor. Moreover, the data subjects did not initiate the processing and did not intend to share their personal data with Xandr and its 4,000 advertising partners for commercial purposes. The nature of the personal data affected, namely data on sexual orientation, was taken into account as well as the fact that Xandr financially benefitted from the unlawful processing. The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect. The DPA held that Xandr acted negligently because Xandr is a leading advertiser technology company and the processing of personal data on a large scale is a core part of its business. Therefore, it can be expected of Xandr to be acquainted and compliant with central data protection requirements. It was negligent of Xandr not to make any assessments regarding the lawfulness of the processing. The amount of fine pursuant to [[Article 83 GDPR|Article 83(5)(a) GDPR]] was based on Xandr’s revenue, not on Microsoft’s because for the time period concerned, Xandr was not a part of Microsoft yet. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.","Norway's Data Protection Authority (Datatilsynet) has fined Xandr NOK 92,000,000 (approximately €8.5 million) for processing personal data of Grindr users without valid consent. The company, acting as a joint controller, engaged in real-time bidding, processing sensitive data including information about users' sexual orientation. The DPA found violations of GDPR Articles 6(1) and 9(1), citing a lack of valid consent and Xandr's significant influence over the processing means and purposes.","Norway's Datatilsynet fines Xandr NOK 92 million for processing Grindr users' data without valid consent.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53381&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-10-13T11:19:39+00:00","2026-10-13T12:00:10.065065+00:00",8,[17,20,23,25],{"name":18,"type":19},"Xandr","vendor",{"name":21,"type":22},"Grindr","product",{"name":24,"type":19},"Microsoft",{"name":26,"type":19},"AppNexus","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":27,"icon":29,"name":30,"slug":31},null,"Privacy Fines","privacy-fines",[33,38,43,48],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":49},{"id":50,"icon":29,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[24,18,26],{"controls":56,"vendors":103},[57,86],{"slug":58,"name":59,"problem":60,"products":61},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":87,"name":88,"problem":89,"products":90},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[91,97],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":92,"product_name":93,"url":95,"description":96},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":98,"product_name":99,"url":101,"description":102},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":105,"title":106,"body":107,"framework_refs":108,"framework_notes":118},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","Xandr, acting as a joint data controller in real-time bidding ecosystems, processed highly sensitive personal data — including users' sexual orientation — without obtaining valid consent under GDPR Articles 6(1) and 9(1). The core failure was the assumption that downstream consent mechanisms were sufficient, without verifying that consent was freely given, specific, informed, and unambiguous as required by law. This case highlights the significant legal liability that arises when companies in advertising supply chains accept and process sensitive data without independently validating the lawful basis for processing. The €8.5 million fine serves as a stark reminder that joint controllers cannot outsource accountability for consent compliance.",[109,110,111,112,113,114,115,116,117],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 9(1) — Processing of special categories of personal data","GDPR Article 26 — Joint controllers","GDPR Article 7 — Conditions for consent","NIST Privacy Framework PR.CO-P3 — Data processing conditions are communicated","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management System (PIMS)","ITIL Service Design — Information Security Policy and Compliance Management",{"CIS Control 3 — Data Protection":119,"GDPR Article 26 — Joint controllers":120,"GDPR Article 7 — Conditions for consent":121,"GDPR Article 6(1) — Lawfulness of processing":122,"ISO\u002FIEC 27701:2019 — Privacy Information Management System (PIMS)":123,"GDPR Article 9(1) — Processing of special categories of personal data":124,"ITIL Service Design — Information Security Policy and Compliance Management":125,"NIST Privacy Framework PR.CO-P3 — Data processing conditions are communicated":126,"NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information":127},"Data protection includes classifying sensitive data like sexual orientation and restricting how it is shared.","Joint controllers must agree and verify their respective responsibilities, rather than assume a partner obtained valid consent.","Conditions for consent require the controller to demonstrate it was obtained, which Xandr could not do for real-time bidding.","Xandr needed a valid lawful basis for processing Grindr users' data, which it lacked by relying on downstream consent.","A PIMS defines processes for verifying consent and controller roles, which would have exposed Xandr's reliance on partners.","Data revealing sexual orientation is a special category, requiring explicit consent that Xandr never obtained.","Compliance management in service design would require verifying lawful basis before sensitive data enters an ad platform.","Communicating processing conditions to individuals is essential when data passes through ad ecosystems like real-time bidding.","Authority to process requires a confirmed legal basis for each use, not an assumption that partners collected consent."]