What Changed
- The Norwegian DPA issued an administrative fine of EUR 8,600,000 against Xandr Inc. for violations of GDPR Articles 6(1) and 9(1).
- The authority ruled that Xandr acted as a joint controller and could not rely on invalid third-party consent obtained by Grindr.
- The DPA established that joint controllers must independently verify that consent is valid and covers their own processing activities.
The Norwegian Data Protection Authority (Datatilsynet) has imposed an administrative fine of EUR 8,600,000 (NOK 92 million) on advertising technology company Xandr Inc. (formerly AppNexus, now part of Microsoft) for processing personal data without a lawful basis under the General Data Protection Regulation (GDPR). The decision, dated 2 October 2026, follows a complaint lodged in 2020 by the Norwegian Consumer Council concerning real-time bidding activities linked to Grindr, a location-based dating application aimed at gay, bi, trans, and queer individuals.
The authority established by a clear preponderance of probability that Xandr processed Grindr users' IP addresses, advertising IDs, and the fact that individuals were using the app during real-time bidding auctions. The DPA categorized this information as personal data under Article 4(1) GDPR and data concerning sexual orientation under Article 9(1) GDPR.
Operating across both supply-side and demand-side platforms, Xandr was designated as a joint controller for the processing activities. Because the operations involved special category personal data, explicit consent under Article 9(2)(a) GDPR was required. Xandr did not collect consent directly and relied on consent obtained by Grindr, which the DPA found to be invalid under Articles 4(11) and 7 GDPR. The DPA affirmed that accountability cannot be outsourced under the GDPR, ruling that every joint controller must independently verify that consent is valid and covers its specific processing operations.
Determining that the violations were at least negligent and involved central GDPR provisions protecting sensitive data, the Norwegian DPA classified the infringements as highly serious. The ruling establishes significant enforcement precedent for adtech providers and ad exchanges operating in the European Economic Area regarding third-party consent reliance.
Who May Be Affected
Adtech companies, advertising exchanges, demand-side and supply-side platforms, mobile app developers, and Grindr users in Norway.
Cross-Border Context
Applies GDPR standards across the European Economic Area (EEA) concerning real-time bidding, joint controller liabilities, and international adtech consent chains.
What to check next
- Verify whether Xandr Inc. or Microsoft files an appeal against the Norwegian DPA decision.
- Monitor further guidance or statements from the EDPB regarding joint controller obligations in programmatic advertising.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.