[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnf0BAQSbBb6VYyIHN-Wd9rioVZKNOGyeK1f7kygXSok":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"566e6e14-13e6-4e99-b554-474348de7e89","xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","b0bfabc3-fad9-45fa-a3ca-b37f0e6213c1","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","Xandr processed sensitive personal data — including advertising IDs, IP addresses, and implied sexual orientation — of Grindr users without a valid legal basis, violating GDPR's strict requirements for explicit consent when handling special category data. As a joint controller in the advertising ecosystem, Xandr inherited accountability for lawful data processing but failed to establish adequate consent mechanisms or verify the legitimacy of data received through the supply chain. The Norwegian DPA's finding of negligence underscores that relying on upstream partners to handle consent does not absolve a data controller of its own legal obligations. This case illustrates how ad-tech supply chains create compounding compliance risks where sensitive data flows across multiple parties with insufficient oversight. The €8.6M fine serves as a stark reminder that accountability in data processing cannot be delegated.","**Immediate actions:**\n- Conduct an audit of all third-party data sources to verify that explicit consent has been obtained for any special category data before processing it.\n- Map all joint-controller relationships and ensure Data Processing Agreements (DPAs) clearly define each party's legal basis for processing.\n\n**Long-term improvements:**\n- Implement a consent management platform that enforces granular, explicit consent collection for special category data prior to any ad-tech data sharing.\n- Establish a formal vendor risk program that includes GDPR compliance assessments for all advertising and data partners in the supply chain.\n- Appoint or empower a Data Protection Officer (DPO) to perform regular reviews of lawful processing bases across all data flows.\n\n**Detection & Governance measures:**\n- Deploy data flow monitoring tools to detect and alert on the movement of special category data (e.g., health, sexual orientation) outside approved processing boundaries.\n- Schedule periodic GDPR compliance audits with a focus on ad-tech integrations and joint-controller arrangements to identify gaps before regulators do.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 6 — Lawfulness of processing","GDPR Article 26 — Joint controllers","GDPR Article 5(1)(a) — Principle of lawfulness, fairness, and transparency","GDPR Article 83(5) — Administrative fines for serious infringements","NIST Privacy Framework PR.AT-P — Awareness and Training for Privacy","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","CIS Control 3 — Data Protection","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)",{},"published","2026-10-16T10:20:42.113376+00:00","2026-10-16T10:20:42.098+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fnorwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en","norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data-d1fefb","Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":56,"name":57,"problem":58},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":60,"name":61,"problem":62},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]