← Back

EDPB (European Data Protection Board) · EU-wide · 16 Oct 2026 · Enforcement action

Norwegian DPA fines Xandr EUR 8,600,000 for unlawful processing of personal data

Original title: Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data

Read at EDPB (European Data Protection Board) ↗
Health Data, Privacy & Security
AI-generated summary

Norway's Data Protection Authority fined Xandr Inc. EUR 8,600,000 on 2 October 2026 for unlawfully processing personal data of Grindr users. The authority found Xandr processed users' advertising IDs, IP addresses, and information about Grindr use—including data revealing sexual orientation—during real-time bidding without valid consent. As a joint controller, Xandr relied on Grindr's invalid consent rather than independently verifying consent for its own processing, violating Articles 6 and 9 of the GDPR.

From EDPB (European Data Protection Board)

- Date of final decision: 2 October 2026

- Controller: Xandr Inc.

- Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)

- Key words: Fines, Basic principles, Marketing, Online platforms

The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people.

The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR and data concerning sexual orientation under Article 9(1) GDPR. Xandr is considered a joint controller for the processing, both as supply-side and demand-side platform. Since the data were special category personal data, explicit consent under Article 9(2)(a) was the relevant legal basis for the processing. Xandr did not obtain consent itself, but relied on Grindr’s consent, which were invalid under Articles 4(11) and 7 GDPR. The DPA holds that accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing. The infringements were at least negligent. In light of the fact that the infringements concern some of the most central provisions in the GDPR, including sensitive data, the Norwegian DPA regards the infringements of high seriousness.

The Norwegian DPA imposed an administrative fine of EUR 8 600 000 on Xandr Inc. for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR.

- Norwegian Press Release: Datatilsynet gir Microsoft-selskap 92 millioner i gebyr | Datatilsynet

- English Press Release: Microsoft company fined NOK 92 million | Datatilsynet

Excerpt from the official page. The original is authoritative.