Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent
Xandr processed sensitive personal data — including advertising IDs, IP addresses, and implied sexual orientation — of Grindr users without a valid legal basis, violating GDPR's strict requirements for explicit consent when handling special category data. As a joint controller in the advertising ecosystem, Xandr inherited accountability for lawful data processing but failed to establish adequate consent mechanisms or verify the legitimacy of data received through the supply chain. The Norwegian DPA's finding of negligence underscores that relying on upstream partners to handle consent does not absolve a data controller of its own legal obligations. This case illustrates how ad-tech supply chains create compounding compliance risks where sensitive data flows across multiple parties with insufficient oversight. The €8.6M fine serves as a stark reminder that accountability in data processing cannot be delegated.
Tactical Insight
Immediate actions
- Conduct an audit of all third-party data sources to verify that explicit consent has been obtained for any special category data before processing it.
- Map all joint-controller relationships and ensure Data Processing Agreements (DPAs) clearly define each party's legal basis for processing.
Long-term improvements
- Implement a consent management platform that enforces granular, explicit consent collection for special category data prior to any ad-tech data sharing.
- Establish a formal vendor risk program that includes GDPR compliance assessments for all advertising and data partners in the supply chain.
- Appoint or empower a Data Protection Officer (DPO) to perform regular reviews of lawful processing bases across all data flows.
Detection & Governance measures
- Deploy data flow monitoring tools to detect and alert on the movement of special category data (e.g., health, sexual orientation) outside approved processing boundaries.
- Schedule periodic GDPR compliance audits with a focus on ad-tech integrations and joint-controller arrangements to identify gaps before regulators do.