Datatilsynet (Norway) - 20/03541-37

Xandr, operating as a joint controller with Grindr, processed highly sensitive personal data — including information revealing users' sexual orientation — through real-time bidding (RTB) without a valid legal basis or explicit consent, violating GDPR Articles 6 and 9. The opaque and complex nature of the AdTech supply chain allowed sensitive data to flow to downstream partners without adequate transparency or user control. This case highlights that companies receiving personal data via programmatic advertising pipelines bear legal responsibility for ensuring consent is valid, not merely that data was passed to them by another party. The record-breaking NOK 92 million fine signals that regulators are increasingly scrutinizing the AdTech ecosystem as a systemic privacy risk, particularly where special category data is involved.