Datatilsynet (Norway) - 20/03541-37
Norway's Datatilsynet fines Xandr €8.5M for unlawful processing of Grindr user data.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Norway's Data Protection Authority (Datatilsynet) has fined Xandr NOK 92 million (approximately €8.5 million) for processing personal and sensitive data of Grindr users without valid consent during real-time bidding. The authority determined that Xandr acted as a joint controller with Grindr, emphasizing that accountability cannot be outsourced and both parties are responsible for GDPR compliance. The fine was based on Xandr's revenue as it was not yet part of Microsoft during the period in question.
The lesson from this incident
Full lessonXandr processed highly sensitive personal data — including sexual orientation inferred from Grindr usage — through real-time bidding (RTB) pipelines without a lawful basis under GDPR. Norway's Datatilsynet ruled that joint controllership responsibilities cannot be delegated away, meaning both the data source (Grindr) and the downstream processor (Xandr) share full accountability for compliance failures. This case highlights how ad-tech supply chains routinely pass sensitive personal data across dozens of third parties, each of whom inherits significant legal obligations. The €8.5 million fine underscores that ignorance of the sensitivity of received data is not a valid legal defense, especially when the data originates from platforms with obvious sensitive-category implications.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.