[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYtMp-P3EGrNxar2iFEJHquJYQDnChGYZwkq6X8vrO8g":3},{"article":4,"iocs":48,"watch_terms":57,"solutions":58,"lesson":61},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"605d5d18-a556-4c7d-b4f8-bb860e4f89bc","Datatilsynet (Norway) - 20\u002F03541-37","datatilsynet-norway-20-03541-37-b26a85","English Machine Translation of the Decision Show changes","Norway's Data Protection Authority (Datatilsynet) has issued an administrative fine to Xandr Inc. for unlawful processing of personal data. The decision stems from complaints filed by the Norwegian Consumer Council regarding the Grindr app. The investigation focused on Xandr's data processing practices and their compliance with GDPR provisions, particularly concerning legal basis and consent.","Norway's Datatilsynet imposes administrative fine on Xandr Inc. for unlawful personal data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53407&oldid=53391","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-10-14T12:46:03+00:00","2026-10-14T14:00:17.843069+00:00",7,[17,20,23,25],{"name":18,"type":19},"Xandr Inc.","vendor",{"name":21,"type":22},"Grindr app","product",{"name":24,"type":19},"Datatilsynet",{"name":26,"type":19},"Forbrukerradet","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":27,"icon":29,"name":30,"slug":31},null,"GDPR","gdpr",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[49,53],{"type":50,"value":51,"context":52},"domain","datatilsynet.no","Official website of the Norwegian Data Protection Authority",{"type":54,"value":55,"context":56},"url","https:\u002F\u002Fstorage02.forbrukerradet.no\u002Fmedia\u002F2026\u002F10\u002Fadministrative-fine-unlawful-processing-of-personal-data-redacted-public-version.pdf","Link to the redacted public version of the administrative fine document from Forbrukerradet",[18,24,26],{"controls":59,"vendors":60},[],[],{"slug":62,"title":63,"body":64,"framework_refs":65,"framework_notes":78},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","Xandr Inc. was fined by Norway's Datatilsynet for processing personal data without a valid legal basis or proper consent, violating core GDPR principles. The case originated from data shared by the Grindr app, which disclosed sensitive user information to advertising partners without meeting GDPR's stringent consent requirements. This highlights how ad-tech ecosystems often inherit liability when downstream data processors fail to independently verify the lawfulness of data flows. The case matters because it demonstrates that third-party data recipients — not just the original collectors — bear accountability under GDPR. Organizations handling personal data for advertising purposes must not assume upstream consent is valid and sufficient.",[66,67,68,69,70,71,72,73,74,75,76,77],"GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 5(1)(a) – Principle of lawfulness, fairness, and transparency","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 30 – Records of processing activities","NIST Privacy Framework PR.AT-P1 – Awareness and Training","NIST SP 800-53 PT-1 – Policy and Procedures for Personally Identifiable Information","NIST SP 800-53 AC-20 – Use of External Information Systems","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL – Supplier Management (third-party risk governance)",{}]