Datatilsynet (Norway) - 20/03541-37
Norway's Datatilsynet imposes administrative fine on Xandr Inc. for unlawful personal data processing.
Run Xandr Inc.?
Get an email when a reviewed story names Xandr Inc., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Norway's Data Protection Authority (Datatilsynet) has issued an administrative fine to Xandr Inc. for unlawful processing of personal data. The decision stems from complaints filed by the Norwegian Consumer Council regarding the Grindr app. The investigation focused on Xandr's data processing practices and their compliance with GDPR provisions, particularly concerning legal basis and consent.
The lesson from this incident
Full lessonXandr Inc. was fined by Norway's Datatilsynet for processing personal data without a valid legal basis or proper consent, violating core GDPR principles. The case originated from data shared by the Grindr app, which disclosed sensitive user information to advertising partners without meeting GDPR's stringent consent requirements. This highlights how ad-tech ecosystems often inherit liability when downstream data processors fail to independently verify the lawfulness of data flows. The case matters because it demonstrates that third-party data recipients — not just the original collectors — bear accountability under GDPR. Organizations handling personal data for advertising purposes must not assume upstream consent is valid and sufficient.
Indicators of Compromise
- domain — datatilsynet.no
- url — https://storage02.forbrukerradet.no/media/2026/10/administrative-fine-unlawful-processing-of-personal-data-redacted-public-version.pdf