Xandr Fined €8.5M for Unlawful Data Processing Under GDPR
Microsoft's Xandr processed highly sensitive personal data — including information on sexual orientation sourced from the Grindr dating app — without a valid legal basis, violating GDPR's core principles around lawful processing and special category data. The root cause is a failure to establish and verify proper consent mechanisms before ingesting and profiling user data from third-party sources. This case illustrates how the adtech industry's opaque data-sharing ecosystems can expose organizations to massive regulatory penalties. It also highlights that receiving data from a third party does not absolve a company of its own GDPR obligations as a data controller or processor.
Tactical Insight
Immediate actions
- Audit all third-party data sources to verify that valid legal bases (e.g., explicit consent) exist before processing any personal or special category data.
- Immediately suspend ingestion of sensitive category data (health, sexual orientation, religion, etc.) from any partner lacking documented, GDPR-compliant consent records.
Long-term improvements
- Implement a Data Processing Agreement (DPA) review process for every data supplier, including periodic re-validation of consent mechanisms.
- Establish a Data Protection by Design framework so that legal basis assessment is a mandatory gate before any new data pipeline is approved.
- Appoint or empower a Data Protection Officer (DPO) to conduct regular internal audits of adtech and data-sharing practices.
Detection & monitoring measures
- Deploy data classification tooling to automatically flag special category data entering processing pipelines for immediate legal review.
- Maintain a comprehensive Record of Processing Activities (RoPA) and review it quarterly to detect unlawful or undocumented data flows.