Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr
Xandr Inc. was fined by Norway's Datatilsynet for processing personal data without a valid legal basis or proper consent, violating core GDPR principles. The case originated from data shared by the Grindr app, which disclosed sensitive user information to advertising partners without meeting GDPR's stringent consent requirements. This highlights how ad-tech ecosystems often inherit liability when downstream data processors fail to independently verify the lawfulness of data flows. The case matters because it demonstrates that third-party data recipients — not just the original collectors — bear accountability under GDPR. Organizations handling personal data for advertising purposes must not assume upstream consent is valid and sufficient.
Tactical Insight
Immediate actions
- Audit all incoming data streams from third-party partners to verify documented legal bases (consent, legitimate interest, etc.) are valid and GDPR-compliant.
- Suspend processing of any personal data where a lawful basis cannot be confirmed until a legal review is completed.
Long-term improvements
- Implement a formal Data Processing Agreement (DPA) review program requiring regular re-validation of consent chains with all upstream data suppliers.
- Establish a Data Protection Officer (DPO)-led review process for any new advertising or data-sharing partnerships before onboarding.
- Maintain a continuously updated Record of Processing Activities (RoPA) to map every data flow and its associated legal basis.
Detection & Governance measures
- Deploy automated consent-verification checks within your data ingestion pipelines to flag records lacking valid consent metadata.
- Conduct annual third-party data compliance audits, including review of partners' privacy notices and consent mechanisms.
- Set up a regulatory monitoring process to track enforcement actions in relevant jurisdictions and assess applicability to your own data practices.