Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding
Xandr, operating as a joint controller with Grindr, processed highly sensitive personal data — including information revealing users' sexual orientation — through real-time bidding (RTB) without a valid legal basis or explicit consent, violating GDPR Articles 6 and 9. The opaque and complex nature of the AdTech supply chain allowed sensitive data to flow to downstream partners without adequate transparency or user control. This case highlights that companies receiving personal data via programmatic advertising pipelines bear legal responsibility for ensuring consent is valid, not merely that data was passed to them by another party. The record-breaking NOK 92 million fine signals that regulators are increasingly scrutinizing the AdTech ecosystem as a systemic privacy risk, particularly where special category data is involved.
Tactical Insight
Immediate Actions
- Audit all third-party data feeds and programmatic advertising integrations to confirm a valid legal basis exists for every category of personal data processed.
- Immediately suspend processing of special category data (health, sexual orientation, religion, etc.) within RTB pipelines until explicit, granular consent mechanisms are verified.
Long-term Improvements
- Establish formal joint-controller agreements (per GDPR Article 26) with all advertising and data-sharing partners, clearly defining each party's responsibilities for lawful processing.
- Implement a Data Protection Impact Assessment (DPIA) process specifically for AdTech and RTB use cases that involve sensitive or inferred personal data.
- Build a comprehensive data inventory and data flow map to track where special category data originates, how it is used, and which third parties receive it.
Detection & Compliance Measures
- Deploy continuous consent-signal monitoring to ensure consent strings passed through the IAB Transparency & Consent Framework (TCF) are valid, granular, and up to date.
- Conduct regular third-party vendor assessments to verify that supply chain partners maintain equivalent data protection standards before onboarding or renewing contracts.