Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding
Xandr processed highly sensitive personal data — including sexual orientation inferred from Grindr usage — through real-time bidding (RTB) pipelines without a lawful basis under GDPR. Norway's Datatilsynet ruled that joint controllership responsibilities cannot be delegated away, meaning both the data source (Grindr) and the downstream processor (Xandr) share full accountability for compliance failures. This case highlights how ad-tech supply chains routinely pass sensitive personal data across dozens of third parties, each of whom inherits significant legal obligations. The €8.5 million fine underscores that ignorance of the sensitivity of received data is not a valid legal defense, especially when the data originates from platforms with obvious sensitive-category implications.
Tactical Insight
Immediate actions
- Audit all third-party data feeds to identify whether sensitive or special-category personal data (Article 9 GDPR) is being received and processed.
- Suspend or reject RTB bid streams that cannot provide documented proof of valid, granular user consent before further processing.
Governance & Compliance measures
- Establish formal Joint Controller Agreements (Article 26 GDPR) with any partner who co-determines the purposes and means of data processing.
- Implement a Data Protection Impact Assessment (DPIA) for all real-time bidding and programmatic advertising workflows involving personal data.
- Appoint a Data Protection Officer (DPO) with specific mandate to review ad-tech integrations and consent chain validity.
Long-term improvements
- Build a comprehensive third-party data inventory mapping every upstream data supplier to the legal basis and sensitivity classification of data received.
- Enforce contractual data minimisation clauses with supply-chain partners to prevent receipt of special-category data unless explicitly required and lawfully justified.
- Conduct regular compliance training for product, engineering, and partnerships teams on GDPR joint controllership and special-category data obligations.