[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzyJeYTHZ4ONpOVp1J6L24kx4XTI01IZ8xCHgiREthvY":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":101},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"eda9ad2b-f0f8-483f-861c-672f8cbff09b","Datatilsynet (Norway) - 20\u002F03541-37","datatilsynet-norway-20-03541-37-a3294f","English Machine Translation of the Decision ← Older revision Revision as of 14:26, 13 October 2026 (2 intermediate revisions by the same user not shown) Line 11: Line 11: |Original_Source_Name_1=Datatilsynet |Original_Source_Name_1=Forbrukerradet |Original_Source_Link_1=https:\u002F\u002Fwww.datatilsynet.no\u002Faktuelt\u002Faktuelle-nyheter-2026\u002Fdatatilsynet-gir-microsoft-selskap-92-millioner-i-bot\u002F |Original_Source_Link_1=https:\u002F\u002Fstorage02.forbrukerradet.no\u002Fmedia\u002F2026\u002F10\u002Fadministrative-fine-unlawful-processing-of-personal-data-redacted-public-version.pdf |Original_Source_Language_1=Norwegian |Original_Source_Language_1=Norwegian |Original_Source_Language__Code_1=NO |Original_Source_Language__Code_1=EN Line 112: Line 112: }} }} The DPA fined Xandr NOK 92 m (€8.5 m) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. The DPA fined Xandr NOK 92 m (€8.5 m) because it processed (sensitive) personal data of Grindr users without valid consent when it engaged in real-time bidding. Xandr acted as a joint controller because in real-time bidding, multiple parties participate in the decision making. == English Summary == == English Summary == Line 141: Line 141: The DPA recurred to the broad understanding of the concept of “controller” according to CJEU case law and took into consideration the opaque practices in the AdTech industry where a large number of companies exchange personal data along complex value chains. It is unlikely in this ecosystem that one actor alone fully controls how the data is processed. According to the DPA, a failure to hold these companies accountable would result in diffusion or elimination of responsibility, also with regard to data subjects’ rights. This would run counter the objective of the GDPR to ensure a high level of data protection. The fact that neither Xandr nor Grindr accepted controllership would result in an evasion of responsibility to answer to data subjects’ rights. However, the notion of controller is a functional concept that is determined by factual circumstances and not by contractual agreements. Since both Xandr and Grindr pursued their respective interests and purposes when processing the personal data, they both exercised decisive influence on the decision on the means of processing. The processing could not have taken place without the contribution of both parties in deciding the purposes and means, making them joint controllers. The DPA recurred to the broad understanding of the concept of “controller” according to CJEU case law and took into consideration the opaque practices in the AdTech industry where a large number of companies exchange personal data along complex value chains. It is unlikely in this ecosystem that one actor alone fully controls how the data is processed. According to the DPA, a failure to hold these companies accountable would result in diffusion or elimination of responsibility, also with regard to data subjects’ rights. This would run counter the objective of the GDPR to ensure a high level of data protection. The fact that neither Xandr nor Grindr accepted controllership would result in an evasion of responsibility to answer to data subjects’ rights. However, the notion of controller is a functional concept that is determined by factual circumstances and not by contractual agreements. Since both Xandr and Grindr pursued their respective interests and purposes when processing the personal data, they both exercised decisive influence on the decision on the means of processing. The processing could not have taken place without the contribution of both parties in deciding the purposes and means, making them joint controllers. While joint controllers may distribute tasks and divide responsibility pursuant to [[Article 26 GDPR|Article 26(1) GDPR]], the accountability principle ([[Article 5 GDPR|Article 5(2) GDPR]]) as well as the obligations under [[Article 24 GDPR]] apply to both controllers. Compliance cannot be outsourced and both controllers are responsible and must demonstrate compliance with the GDPR, for example when it comes to determining a legal basis for the processing. While joint controllers may distribute tasks and divide responsibility pursuant to [[Article 26 GDPR|Article 26(1) GDPR]], the accountability principle ([[Article 5 GDPR|Article 5(2) GDPR]]) as well as the obligations under [[Article 24 GDPR]] apply to both controllers. Compliance cannot be outsourced and both controllers are responsible and must demonstrate compliance with the GDPR, for example when it comes to determining a legal basis for the processing. The DPA found that Xandr processed special categories of personal data pursuant to [[Article 9 GDPR|Article 9(1) GDPR]]. The information that a person is being registered on Grindr is to be considered information about someone’s sexual orientation. The DPA found that Xandr processed special categories of personal data pursuant to [[Article 9 GDPR|Article 9(1) GDPR]]. The information that a person is being registered on Grindr is to be considered information about someone’s sexual orientation. In the separate Grindr case before the DPA, the DPA found that the information that data subjects were Grindr users was not “manifestly made public” by the data subjects pursuant to [[Article 9 GDPR|Article 9(2)(e) GDPR]]. Xandr could also not rely on explicit consent pursuant to [[Article 9 GDPR|Article 9(2)(a) GDPR]]. It never obtained the consent directly from the data subjects itself. The consent that Grindr obtained from its users did not fulfil the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR]]. Therefore, it was invalid. In the separate Grindr case before the DPA, the DPA found that the information that data subjects were Grindr users was not “manifestly made public” by the data subjects pursuant to [[Article 9 GDPR|Article 9(2)(e) GDPR]]. Xandr could also not rely on explicit consent pursuant to [[Article 9 GDPR|Article 9(2)(a) GDPR]]. It never obtained the consent directly from the data subjects itself. The consent that Grindr obtained from its users did not fulfil the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR]]. Therefore, it was invalid. Line 154: Line 156: The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect. The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect. The DPA held that Xandr acted negligently because Xandr is a leading advertiser technology company and the processing of personal data on a large scale is a core part of its business. Therefore, it can be expected of Xandr to be acquainted and compliant with central data protection requirements. It was negligent of Xandr not to make any assessments regarding the lawfulness of the processing. The DPA held that Xandr acted negligently because Xandr is a leading advertiser technology company and the processing of personal data on a large scale is a core part of its business. Therefore, it can be expected of Xandr to be acquainted and compliant with central data protection requirements. It was negligent of Xandr not to make any assessments regarding the lawfulness of the processing. The amount of fine pursuant to [[Article 83 GDPR|Article 83(5)(a) GDPR]] was based on Xandr’s revenue, not on Microsoft’s because for the time period concerned, Xandr was not a part of Microsoft yet. The amount of fine pursuant to [[Article 83 GDPR|Article 83(5)(a) GDPR]] was based on Xandr’s revenue, not on Microsoft’s because for the time period concerned, Xandr was not a part of Microsoft yet.","Norway's Data Protection Authority (Datatilsynet) has fined Xandr NOK 92 million (approximately €8.5 million) for processing personal and sensitive data of Grindr users without valid consent during real-time bidding. The authority determined that Xandr acted as a joint controller with Grindr, emphasizing that accountability cannot be outsourced and both parties are responsible for GDPR compliance. The fine was based on Xandr's revenue as it was not yet part of Microsoft during the period in question.","Norway's Datatilsynet fines Xandr €8.5M for unlawful processing of Grindr user data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53391&oldid=53387","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-10-13T14:26:00+00:00","2026-10-13T16:00:03.764403+00:00",7,[17,20,23,25],{"name":18,"type":19},"Xandr","vendor",{"name":21,"type":22},"Grindr","product",{"name":24,"type":19},"Microsoft",{"name":26,"type":27},"AdTech","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":28,"icon":30,"name":31,"slug":32},null,"Policy","policy",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[24,18,21],{"controls":54,"vendors":100},[55,83],{"slug":56,"name":57,"problem":58,"products":59},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[60,68,75],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":69,"vendor_name":24,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":84,"name":85,"problem":86,"products":87},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[88,94],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":89,"product_name":90,"url":92,"description":93},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":95,"product_name":96,"url":98,"description":99},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":102,"title":103,"body":104,"framework_refs":105,"framework_notes":118},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","Xandr processed highly sensitive personal data — including sexual orientation inferred from Grindr usage — through real-time bidding (RTB) pipelines without a lawful basis under GDPR. Norway's Datatilsynet ruled that joint controllership responsibilities cannot be delegated away, meaning both the data source (Grindr) and the downstream processor (Xandr) share full accountability for compliance failures. This case highlights how ad-tech supply chains routinely pass sensitive personal data across dozens of third parties, each of whom inherits significant legal obligations. The €8.5 million fine underscores that ignorance of the sensitivity of received data is not a valid legal defense, especially when the data originates from platforms with obvious sensitive-category implications.",[106,107,108,109,110,111,112,113,114,115,116,117],"GDPR Article 5 – Principles of data processing (lawfulness, purpose limitation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 26 – Joint controllers","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 83 – General conditions for imposing fines","NIST Privacy Framework PR.DS-P1 – Data processing policies","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection (Data Inventory and Classification)","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","IAB TCF (Transparency & Consent Framework) – Consent signal validation in RTB",{}]