Full Report
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements
Analysis Summary
# Regulation/Compliance: GDPR Enforcement – Xandr Data Privacy Breach
## Overview
This enforcement action involves the illegal processing and relaying of sensitive personal data (sexual orientation) belonging to users of the dating app Grindr. The Norwegian Data Protection Authority (DPA) determined that Xandr, acting as an intermediary in real-time bidding (RTB) auctions, failed to establish a valid legal basis for data processing, violating the General Data Protection Regulation (GDPR).
## Key Details
- **Issuing Authority:** Norwegian Data Protection Authority (Datatilsynet)
- **Effective Date:** October 13, 2026 (Decision Date); Violations occurred July 2018 – April 2020.
- **Jurisdiction:** Norway / European Economic Area (EEA)
- **Status:** Final Administrative Penalty (Subject to appeal)
## Requirements
### Mandatory Requirements
1. **Valid Legal Basis (Consent):** Under GDPR Article 6 (and Article 9 for sensitive data), controllers must obtain explicit, informed, and granular consent before processing data revealing sexual orientation.
2. **Joint Controller Responsibility:** Organizations acting as intermediaries in data ecosystems must independently verify that valid consent was obtained; they cannot "point fingers" at the original data collector (e.g., the app provider).
3. **Transparency in RTB:** Processing activities in real-time bidding must be transparent to the user, not "completely hidden."
### Recommended Practices
1. **Due Diligence in Acquisitions:** Acquiring firms (like Microsoft) should perform rigorous audits of the target’s historical data processing practices to identify legacy liabilities.
2. **Supply Chain Audits:** Ad-tech participants should implement technical "checkpoints" to verify consent strings (like TCF) before relaying data to sub-processors.
## Affected Organizations
- **Industries:** Ad-tech, Digital Marketing, Mobile Applications (Dating, Health, Religion).
- **Organization Size:** Large-scale data processors and intermediaries.
- **Geographic Scope:** Any entity processing the personal data of individuals located in the EEA.
## Compliance Timeline
- **July 2018 – April 2020:** Period of non-compliance/infringement.
- **2020:** Initial complaint filed by the Norwegian Consumer Council and *noyb*.
- **October 13, 2026:** Fine issued by the Norwegian DPA.
- **Three weeks from decision:** Deadline for Xandr to appeal the decision.
## Implementation Guidance
### Assessment Phase
- Identify all data flows where the organization acts as a "Joint Controller" or intermediary.
- Audit the legal basis for processing "Special Category Data" (sensitive data) within the advertising stack.
### Implementation Phase
- Implement robust Consent Management Platforms (CMPs) that communicate across the programmatic advertising ecosystem.
- Update contracts to clearly define responsibilities between joint controllers.
### Validation Phase
- Verify that real-time bidding requests do not broadcast sensitive attributes without explicit, validated user opt-ins.
## Technical Requirements
- **Consent String Verification:** Technical mechanisms to parse and honor transparency and consent frameworks.
- **Data Minimization:** Ensuring sensitive attributes are not relayed to "thousands of actors" unless strictly necessary and legally permitted.
## Penalties & Enforcement
- **Fines:** €8.6 million ($9.62 million)—the largest fine ever issued by the Norwegian DPA.
- **Other Consequences:** Reputational damage; precedent-setting for the "commercial surveillance" and RTB industry.
- **Enforcement:** Administrative penalty based on a percentage of total annual turnover during the infringement period.
## Related Standards
- **GDPR Article 9:** Specific protections for sensitive personal data (special categories).
- **IAB TCF (Transparency and Consent Framework):** The industry standard often used (and scrutinized) in these RTB scenarios.
## Resources
- **Official Documentation:** [https://www[.]datatilsynet[.]no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/]
- **Advocacy Group:** [https://noyb[.]eu/en/privacy-win-norwegian-authority-fines-microsofts-xandr-eu-85-million]
## Practical Recommendations
- **Do not assume compliance:** Intermediaries must not rely solely on the "upstream" provider's claims of having obtained consent.
- **Review Joint Controller Agreements:** Ensure that liability for data breaches is clearly allocated and that audit rights are included.
- **Sanitize Ad Requests:** Remove sensitive metadata from bid requests if explicit consent cannot be programmatically verified in real-time.