[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftsdu2cl8B1k0oKnUKC7J_ntqvBi-4gytkxUQTWQf7ac":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"b0bfabc3-fad9-45fa-a3ca-b37f0e6213c1","Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data","norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data-d1fefb","Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data ikerinar Fri, 16\u002F10\u002F2026 - 09:52","The Norwegian Data Protection Authority (DPA) has fined Xandr Inc. EUR 8,600,000 for unlawfully processing sensitive personal data of Grindr users. Xandr, acting as a joint controller, processed users' advertising IDs and IP addresses without a valid legal basis, specifically failing to obtain explicit consent for processing data concerning sexual orientation, which is considered special category data under GDPR. The DPA found Xandr's infringements to be at least negligent and of high seriousness, emphasizing that accountability cannot be outsourced.","Norwegian DPA fines Xandr EUR 8.6M for unlawful processing of sensitive personal data.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fnorwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en",null,"2026-10-16T07:52:03+00:00","2026-10-16T10:00:03.945365+00:00",8,[17,20,23],{"name":18,"type":19},"Xandr","vendor",{"name":21,"type":22},"Grindr","product",{"name":24,"type":19},"Microsoft","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":25,"icon":12,"name":27,"slug":28},"Privacy Fines","privacy-fines",[30,35,40,45],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":46},{"id":25,"icon":12,"name":27,"slug":28},[],[24,18,21],{"controls":50,"vendors":122},[51,79,105],{"slug":52,"name":53,"problem":54,"products":55},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":73,"vendor_name":24,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":80,"name":81,"problem":82,"products":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":73,"vendor_name":24,"vendor_logo":74,"product_slug":101,"product_name":102,"url":103,"description":104},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":106,"name":107,"problem":108,"products":109},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[110,116],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":118,"url":120,"description":121},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[123],{"slug":73,"name":24,"logo_path":74,"roles":124},[125],"affected",{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":141},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","Xandr processed sensitive personal data — including advertising IDs, IP addresses, and implied sexual orientation — of Grindr users without a valid legal basis, violating GDPR's strict requirements for explicit consent when handling special category data. As a joint controller in the advertising ecosystem, Xandr inherited accountability for lawful data processing but failed to establish adequate consent mechanisms or verify the legitimacy of data received through the supply chain. The Norwegian DPA's finding of negligence underscores that relying on upstream partners to handle consent does not absolve a data controller of its own legal obligations. This case illustrates how ad-tech supply chains create compounding compliance risks where sensitive data flows across multiple parties with insufficient oversight. The €8.6M fine serves as a stark reminder that accountability in data processing cannot be delegated.",[131,132,133,134,135,136,137,138,139,140],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 6 — Lawfulness of processing","GDPR Article 26 — Joint controllers","GDPR Article 5(1)(a) — Principle of lawfulness, fairness, and transparency","GDPR Article 83(5) — Administrative fines for serious infringements","NIST Privacy Framework PR.AT-P — Awareness and Training for Privacy","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","CIS Control 3 — Data Protection","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)",{}]