Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
Norwegian DPA fines Xandr EUR 8.6M for unlawful processing of sensitive personal data.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Norwegian Data Protection Authority (DPA) has fined Xandr Inc. EUR 8,600,000 for unlawfully processing sensitive personal data of Grindr users. Xandr, acting as a joint controller, processed users' advertising IDs and IP addresses without a valid legal basis, specifically failing to obtain explicit consent for processing data concerning sexual orientation, which is considered special category data under GDPR. The DPA found Xandr's infringements to be at least negligent and of high seriousness, emphasizing that accountability cannot be outsourced.
The lesson from this incident
Full lessonXandr processed sensitive personal data — including advertising IDs, IP addresses, and implied sexual orientation — of Grindr users without a valid legal basis, violating GDPR's strict requirements for explicit consent when handling special category data. As a joint controller in the advertising ecosystem, Xandr inherited accountability for lawful data processing but failed to establish adequate consent mechanisms or verify the legitimacy of data received through the supply chain. The Norwegian DPA's finding of negligence underscores that relying on upstream partners to handle consent does not absolve a data controller of its own legal obligations. This case illustrates how ad-tech supply chains create compounding compliance risks where sensitive data flows across multiple parties with insufficient oversight. The €8.6M fine serves as a stark reminder that accountability in data processing cannot be delegated.
What helps against this
How we list vendors
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.