Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent
Xandr, acting as a joint data controller in real-time bidding ecosystems, processed highly sensitive personal data — including users' sexual orientation — without obtaining valid consent under GDPR Articles 6(1) and 9(1). The core failure was the assumption that downstream consent mechanisms were sufficient, without verifying that consent was freely given, specific, informed, and unambiguous as required by law. This case highlights the significant legal liability that arises when companies in advertising supply chains accept and process sensitive data without independently validating the lawful basis for processing. The €8.5 million fine serves as a stark reminder that joint controllers cannot outsource accountability for consent compliance.
Tactical Insight
Immediate actions
- Audit all data flows involving special category data (e.g., health, sexual orientation, religion) to confirm a valid lawful basis exists before any processing occurs.
- Suspend real-time bidding integrations that rely on unverified or assumed consent signals from third-party platforms.
- Review and update joint controller agreements to explicitly define each party's responsibility for obtaining and validating consent.
Long-term improvements
- Implement a Consent Management Platform (CMP) that captures, stores, and makes auditable consent records for all data subjects.
- Establish a Data Protection Impact Assessment (DPIA) process mandating review before onboarding any new advertising partner or bidding ecosystem.
- Train product, engineering, and business development teams on GDPR obligations for special category data to prevent unlawful processing by design.
Detection & monitoring measures
- Deploy continuous monitoring of data-sharing pipelines to detect when sensitive data attributes are being transmitted without verified consent flags.
- Schedule quarterly privacy compliance audits covering all third-party data processors and joint controllers in the advertising stack.