[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl6Woeh8nXMEBTuDNY-VcU-WrFNA5HJ77dSqF7gvYo6A":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":31,"created_at":32,"published_at":33,"article":34,"tags":38,"podcasts":57,"controls":58},"50ac771e-1ad6-4227-a7b7-a9ca4aa8603a","xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","d76ceb3d-4970-4c22-9c5f-a173ce82a140","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","Xandr, acting as a joint data controller in real-time bidding ecosystems, processed highly sensitive personal data — including users' sexual orientation — without obtaining valid consent under GDPR Articles 6(1) and 9(1). The core failure was the assumption that downstream consent mechanisms were sufficient, without verifying that consent was freely given, specific, informed, and unambiguous as required by law. This case highlights the significant legal liability that arises when companies in advertising supply chains accept and process sensitive data without independently validating the lawful basis for processing. The €8.5 million fine serves as a stark reminder that joint controllers cannot outsource accountability for consent compliance.","**Immediate actions:**\n- Audit all data flows involving special category data (e.g., health, sexual orientation, religion) to confirm a valid lawful basis exists before any processing occurs.\n- Suspend real-time bidding integrations that rely on unverified or assumed consent signals from third-party platforms.\n- Review and update joint controller agreements to explicitly define each party's responsibility for obtaining and validating consent.\n\n**Long-term improvements:**\n- Implement a Consent Management Platform (CMP) that captures, stores, and makes auditable consent records for all data subjects.\n- Establish a Data Protection Impact Assessment (DPIA) process mandating review before onboarding any new advertising partner or bidding ecosystem.\n- Train product, engineering, and business development teams on GDPR obligations for special category data to prevent unlawful processing by design.\n\n**Detection & monitoring measures:**\n- Deploy continuous monitoring of data-sharing pipelines to detect when sensitive data attributes are being transmitted without verified consent flags.\n- Schedule quarterly privacy compliance audits covering all third-party data processors and joint controllers in the advertising stack.",[12,13,14,15,16,17,18,19,20],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 9(1) — Processing of special categories of personal data","GDPR Article 26 — Joint controllers","GDPR Article 7 — Conditions for consent","NIST Privacy Framework PR.CO-P3 — Data processing conditions are communicated","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management System (PIMS)","ITIL Service Design — Information Security Policy and Compliance Management",{"CIS Control 3 — Data Protection":22,"GDPR Article 26 — Joint controllers":23,"GDPR Article 7 — Conditions for consent":24,"GDPR Article 6(1) — Lawfulness of processing":25,"ISO\u002FIEC 27701:2019 — Privacy Information Management System (PIMS)":26,"GDPR Article 9(1) — Processing of special categories of personal data":27,"ITIL Service Design — Information Security Policy and Compliance Management":28,"NIST Privacy Framework PR.CO-P3 — Data processing conditions are communicated":29,"NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information":30},"Data protection includes classifying sensitive data like sexual orientation and restricting how it is shared.","Joint controllers must agree and verify their respective responsibilities, rather than assume a partner obtained valid consent.","Conditions for consent require the controller to demonstrate it was obtained, which Xandr could not do for real-time bidding.","Xandr needed a valid lawful basis for processing Grindr users' data, which it lacked by relying on downstream consent.","A PIMS defines processes for verifying consent and controller roles, which would have exposed Xandr's reliance on partners.","Data revealing sexual orientation is a special category, requiring explicit consent that Xandr never obtained.","Compliance management in service design would require verifying lawful basis before sensitive data enters an ad platform.","Communicating processing conditions to individuals is essential when data passes through ad ecosystems like real-time bidding.","Authority to process requires a confirmed legal basis for each use, not an assumption that partners collected consent.","published","2026-10-13T12:20:47.82565+00:00","2026-10-13T12:20:47.783+00:00",{"id":7,"url":35,"slug":36,"title":37},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53381&oldid=0","datatilsynet-norway-20-03541-37-607b9e","Datatilsynet (Norway) - 20\u002F03541-37",[39,45,51],{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":52,"name":53,"slug":54,"description":55,"color":56},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[59,63],{"slug":60,"name":61,"problem":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":64,"name":65,"problem":66},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]