TL;DR
In a final decision of 2 October 2026, published by the EDPB on 16 October, the Norwegian data protection authority fined Xandr Inc. (formerly AppNexus, now part of Microsoft) €8.6 million, NOK 92 million. Xandr processed Norwegian Grindr users' data during real-time bidding without a legal basis (Article 6(1)) and without a valid exemption for data concerning sexual orientation (Article 9(1)). The consent collected by Grindr was invalid, and Xandr had not checked it.
How the case began
The complaint dates from 2020 and was filed by the Norwegian Consumer Council (Forbrukerrådet). It concerns real-time bidding inside Grindr, the location-based dating app aimed at gay, bi, trans and queer people: every time an ad slot opens, the user's data is offered to a crowd of advertisers who bid within milliseconds. In 2021 the same authority had fined Grindr NOK 65 million for sharing data with advertising partners.
What the authority found
- DATA PROCESSED. At least the fact that a person used Grindr, the advertising ID and the IP address: personal data under Article 4(1) and, because of the use of the app itself, data concerning sexual orientation under Article 9(1).
- JOINT CONTROLLERSHIP. Xandr is a joint controller of the processing, both as supply-side platform (SSP) and as demand-side platform (DSP).
- LEGAL BASIS. As special category data were involved, the relevant basis was explicit consent under Article 9(2)(a). Xandr did not collect it: it relied on Grindr's.
- INVALID CONSENT. Grindr's consent did not meet Articles 4(11) and 7, so it could not cover Xandr's processing either.
- SERIOUSNESS. At least negligent infringements, of central provisions of the Regulation and on sensitive data: of high seriousness, in the authority's view.
Accountability cannot be outsourced
This is the point that goes beyond adtech. Datatilsynet states that each joint controller must independently verify that consent is valid and covers its own processing. A contractual clause in which the partner 'warrants' that consent was collected is not enough if nobody then checks how that consent is requested.
What it means for the DPO
Four checks
One: map the SDKs and advertising partners in the client's apps and websites, and which data they receive. Two: ask whether the context itself reveals a special category (an app about health, religion or sexual orientation): if so, it is explicit consent or nothing. Three: for every consent received from a third party, keep evidence of how it was requested and that it covers exactly that processing. Four: put in place the Article 26 arrangement with whoever jointly determines purposes and means.
The decision fits a now consistent European line on real-time bidding, from the Court of Justice's 2024 judgment on IAB Europe's TCF to the inquiries into ad-tech intermediaries. For anyone receiving data from an app, the question is no longer 'does the partner have consent?' but 'have I checked it myself?'.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
