Norway’s data protection authority, Datatilsynet, has fined Xandr, the ad tech company that is now part of Microsoft, NOK 92 million over Grindr users’ data in real-time bidding. The Xandr fine comes with two documents that differ on several points. The press release, published on 12 October, calls it the highest fine the authority has issued to date. The decision, dated 2 October and addressed to Xandr Inc., finds violations of Article 6(1) and Article 9(1) GDPR.
What did the Norwegian Data Protection Authority decide about Xandr?
The decision says the authority fined Xandr Inc., formerly AppNexus, NOK 92 000 000 for processing the personal data of Grindr users in Norway without a legal basis, and for processing data concerning sexual orientation without a valid exemption, both between 20 July 2018 and 7 April 2020. It says Xandr was a joint controller with Grindr and relied on Grindr’s consent, which was invalid, instead of obtaining its own. Accountability, in the decision’s words, cannot be outsourced.
Do the press release and the decision say the same thing?
Not on every point. Set side by side, the press release and the 54-page decision differ on four points.
| Point and press release (12 October) | Decision (dated 2 October) |
|---|---|
| Euro value “equivalent to €8.6 million” |
“approximately EUR 8 500 000”, at a 15 September rate of 10,79 quoted by Norges Bank |
| People affected Line Coll, Director General: “Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data” |
“Thousands of Grindr users were subject to the unlawful sharing by Grindr to other third parties.” The decision then says the authority “does not know the exact number of data subjects affected by Xandr’s processing” and “will not place any weight on this consideration” |
| Record “the highest fine it has issued to date” |
The decision does not rank the fine. |
| Other companies Data relayed to “potentially thousands of other companies” |
At the time of investigation, Xandr’s list of third-party providers “included more than 4000 companies” |
What did Xandr point to, and how did the decision answer?
A consent clause. The decision says Xandr never obtained consent directly from the Norwegian Grindr users. Instead Xandr relied on Grindr to assess whether consent was required and contractually obliged Grindr to obtain valid consent if applicable. One controller can collect consent for another by contract, the decision accepts, but only if both ensure that the consent “covers the specific processing activities of both of them”. It adds that Xandr “did not take any measures” to verify that the consent was valid and covered its processing. On page 34 the decision states: “Compliance can never be outsourced.” The press release puts it differently: the authority “does not accept that actors can simply blame one another.”
A clause banning special category data. Xandr argued that clause 6.1 of its standard Master Services Agreement expressly prohibited Grindr from sharing such data. The decision’s answer: “such a formality in the form of a contractual commitment between controllers does not relieve Xandr of its responsibility, when it de facto processed sensitive personal data pursuant to Article 9.”
Deleted records. The decision says Xandr could not produce certain documentation, arguing that it had been deleted in accordance with its legal obligations and data retention policies between 16 July 2020 and 6 February 2023. It adds that Xandr had been aware of the investigation since 21 February 2020. Deletion of potential evidence after an investigation has begun, the decision says, “cannot be invoked in Xandr’s favour”.
Which purposes did Xandr itself list for the data?
The decision quotes Xandr’s own description of its work as a demand-side platform. Besides bidding on inventory and delivering ads, the decision says, Xandr stated that it may have processed personal data for “Creating measurement and attribution reporting on ads delivered” and “Frequency and recency capping”. On the supply side, Xandr stated that it was operating as a controller for frequency and time capping, for the security of its services, and for detecting invalid inventory and fraud. The decision concludes that Xandr was a joint controller “both in its role as SSP and DSP”.
How was the Xandr fine calculated?
The press release says the amount was calculated on Xandr’s own total annual turnover, because Xandr was not part of Microsoft in the period in question. The decision starts from the other end: since Microsoft now owns Xandr, the fine “should be calculated – at least as a starting point – on the basis of a percentage of Microsoft’s annual turnover”. It then concludes that, because Microsoft did not own Xandr during the investigation period, “it would not be appropriate or proportionate to base a fine on the turnover of Microsoft”.
Xandr’s revenue figures are blanked out in the public version. What remains is the ceiling: “EUR 20 000 000 is higher than 4 % of Xandr’s total worldwide annual turnover”, so the legal maximum under Article 83(5) is EUR 20 000 000. The decision also places the fine inside a range of EUR 4 million to EUR 20 million that it takes from the EDPB’s Guidelines 04/2022 for infringements with a high level of seriousness. Those are the guidelines on calculating fines, not the EDPB’s Guidelines 04/2026 on choosing between a fine and other corrective measures, adopted on 17 September.
The decision calls the infringements “at least negligent”. It treats the length of the case handling as a mitigating factor and says the fine has been reduced, without stating by how much.
What does the decision not cover?
It concerns Grindr users in Norway only, from 20 July 2018 to 7 April 2020. It also states that it made no legal assessment of Grindr or of MoPub, which Grindr used for ad mediation, in the present case. Grindr’s own Form 8-K on its £26 million UK settlement, a separate matter, was filed on 4 September and does not name a single third party. The Norwegian decision is addressed to a company that received the data of Grindr users in Norway.
The press release and the decision both give Xandr three weeks from receipt to appeal. Neither says whether Xandr will. noyb, which says it filed the 2020 complaint in cooperation with the Norwegian Consumer Council, quotes its lawyer Felix Mikolasch: “This sets a valuable precedent for similar cases.” PPC Land also reported on the fine.
What should ad tech and analytics teams check?
Each point below is something the decision held in this case, set against the practice it touches.
- Consent collected by a partner. A contract clause obliging Grindr to obtain consent did not discharge Xandr. The decision says each joint controller must independently verify that consent is valid and covers its own processing.
- Clauses that forbid sensitive data. A clause prohibiting special category data did not relieve Xandr once it de facto processed such data.
- Retention schedules during an investigation. The deletion of potential evidence after the investigation began could not be invoked in Xandr’s favour.
- App identifiers in bid requests. Processing Grindr users’ advertising ID and IP address alongside the app name, ID or URL was held to be processing data concerning sexual orientation.