Summary

  • Datatilsynet’s 2 October decision fined Xandr NOK 92 million (€8.6 million) for unlawful processing of Grindr users’ data during Norwegian real-time bidding between July 2018 and April 2020.
  • The authority treated Xandr as a joint controller on both sides of the auction and said it had to verify that consent was valid and covered its own processing, rather than assume Grindr had done so.

A bidder is not only a conduit

The Norwegian Data Protection Authority, Datatilsynet, has imposed its highest fine to date on an advertising intermediary. Its decision of 2 October 2026 holds Xandr Inc. responsible for processing data about people using Grindr in Norway during real-time bidding. The penalty is NOK 92 million, or about €8.6 million. The authority announced the outcome on 12 October; the European Data Protection Board listed it as national news four days later.

The case began with a complaint from the Norwegian Consumer Council in 2020. The investigation concerns conduct from 20 July 2018 to 7 April 2020, not a current audit of Xandr’s operations. Datatilsynet found that bid requests could include the fact that a person used Grindr, an advertising identifier and an IP address. In the authority’s assessment, the app-use information revealed sexual orientation and therefore fell within the GDPR’s special-category protections.

That point changes the governance question. A real-time auction can make a disclosure look like a machine-to-machine event: an app opens an advertising opportunity, platforms exchange a bid request and buyers compete to show an advert. The user may see none of those handoffs. Datatilsynet’s decision asks who is responsible for the processing that occurs inside them, not merely who designed the consent screen at the front door.

Consent cannot be borrowed by assumption

Datatilsynet found that Xandr took part as both a supply-side and demand-side platform and was a joint controller with Grindr for the processing at issue. The authority concluded that there was no lawful basis under GDPR Article 6(1), and no valid Article 9 exception for processing data concerning sexual orientation. Explicit consent was the relevant route identified in the decision, but the authority found that Xandr had relied on Grindr’s consent without independently establishing that it was valid and covered Xandr’s own operations.

The practical holding is narrower than a general ban on advertising auctions. A company cannot treat another participant’s consent as an assurance that automatically travels through the chain. Where an organisation is a joint controller, the decision says, accountability cannot be outsourced: it must check the legal basis for the processing it performs. That is especially consequential when a signal that looks like ordinary app activity can expose a protected characteristic.

The authority’s press release says Xandr relayed information to potentially thousands of other companies. “Potentially” matters. The public decision supports the finding that data were processed in bid requests; it does not establish that every possible recipient received or retained them. The number of downstream actors illustrates the opacity of the market, but it should not be converted into a verified count of disclosures.

One episode, separate controllers

The Xandr decision follows a separate NOK 65 million fine Datatilsynet imposed on Grindr in 2021 for Grindr’s own processing and disclosure. The 2026 decision addresses a different company’s role in the same historical advertising environment. It is not one enlarged fine against a single defendant, and it does not simply repeat the earlier decision: it tests whether the intermediary itself had to establish the legal basis for its part in the flow.

That distinction is important for boards and compliance teams. A publisher or app cannot assume that a platform’s participation removes its own duties; a platform cannot assume that the publisher’s consent covers every downstream purpose. Contract language can allocate tasks, but the regulator’s finding is that a joint controller still has to know what its own processing does and why it is lawful.

The liable company’s own time and turnover

The amount also carries a corporate boundary. Xandr was acquired by Microsoft in 2022, after the investigated period. Datatilsynet says it calculated the fine using Xandr’s own annual turnover and did not use Microsoft’s turnover because Xandr was not part of Microsoft when the conduct occurred. The decision therefore ties the sanction to the company and period assessed, rather than to the later parent’s scale.

Xandr has three weeks from receipt of the decision to appeal. The public notice does not state the receipt date, so the deadline cannot be calculated from the 2 October decision date alone. Nor does the notice establish whether an appeal has been filed. The finding is a final decision of the Norwegian authority, but its availability for appeal remains part of the procedural record.

A governance test, not a new GDPR rule

The decision applies existing GDPR duties to specific evidence about a historical bid stream. It does not say that every real-time bidding platform is automatically a joint controller, that all auctions are unlawful, or that Microsoft itself was responsible for the 2018–20 conduct. Its broader significance is analytical: role in the flow, data visible in a request and the purpose of processing matter more than the label attached to a technical intermediary.

Daniel Kade’s proposed safeguard is a consent-verification receipt for each participant and purpose. It would identify the data and operation, the party’s role, the consent version presented, the scope conveyed to each recipient, the legal basis relied on and evidence that the recipient independently checked its coverage. This is an editorial proposal, not a requirement announced by Datatilsynet. Its purpose is to make the handoff testable before an auction begins, rather than reconstructing it after a regulator asks who knew what.

The available record leaves important limits. The underlying conduct ended in April 2020; the decision cannot establish what Xandr or its later parent does today. The public summary does not identify every recipient, show that all potential recipients obtained the data, or settle the appeal. It does establish why a hidden bid request can still be a governance act: data protection responsibility follows the processing role, even when the interface and consent mechanism belong to somebody else.

Sources