Norway fines Xandr EUR 8.6 million for unlawful data processing

Background informationDate of final decision: 2 October 2026National case Controller: Xandr Inc.Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)Decision: Administrative fineKey words: Fines, Basic principles, Marketing, Online platformsSummary of the DecisionOrigin of the case  The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people.Key Findings The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR and data concerning sexual orientation under Article 9(1) GDPR. Xandr is considered a joint controller for the processing, both as supply-side and demand-side platform. Since the data were special category personal data, explicit consent under Article 9(2)(a) was the relevant legal basis for the processing. Xandr did not obtain consent itself, but relied on Grindr’s consent, which were invalid under Articles 4(11) and 7 GDPR. The DPA holds that accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing. The infringements were at least negligent. In light of the fact that the infringements concern some of the most central provisions in the GDPR, including sensitive data, the Norwegian DPA regards the infringements of high seriousness.DecisionThe Norwegian DPA imposed an administrative fine of EUR 8 600 000 on Xandr Inc. for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR.For further information: Norwegian Press Release: Datatilsynet gir Microsoft-selskap 92 millioner i gebyr | DatatilsynetEnglish Press Release: Microsoft company fined NOK 92 million | Datatilsynet