Bidding on Sensitive Data: Norway's Record Fine Against Xandr

1 INTRODUCTION
On 12 October 2026, the Authority announced its record NOK 92 million fine against Xandr Inc., a U.S. AdTech company owned by Microsoft Corporation since June 2022. It found that Xandr processed Norwegian Grindr users' personal data without a legal basis under Article 6(1) of the General Data Protection Regulation (GDPR) and without an applicable exception under Article 9(2) to the prohibition in Article 9(1) on processing special categories of personal data revealing sexual orientation. The infringements arose from Xandr's role as an intermediary on both the supply and demand sides of RTB auctions.

2 BACKGROUND
Xandr connects marketers and media owners through data-led advertising. Grindr LLC is a U.S. company operating a location-based dating app marketed as the world's largest network for gay, bisexual, trans and queer people. The case concerns its free version, funded by advertising, including personalised ads based on data shared with partners such as Xandr.
On 14 January 2020, the Norwegian Consumer Council (NCC), acting for a Norwegian Grindr user, lodged a complaint against Grindr and three advertising partners, including Xandr (then AppNexus), alleging breaches of Articles 6 and 9 GDPR. The NCC commissioned a security firm to test the app's data transmissions. Testing confirmed that Xandr collected the app name and users' advertising ID and IP address, which Xandr acknowledged processing when handling ad and bid requests.
Opening Grindr caused users' personal data to be relayed through Xandr to potentially thousands of advertising actors, allowing advertisers to bid for targeted ad placements.
Opening the app triggered an ad request to Xandr's platform. Xandr helped Grindr sell advertising space while bidding on advertisers' behalf. The Authority found that this dual role made Xandr a joint controller with Grindr.

3 THE AUTHORITY'S REASONING
The Authority concluded that Xandr had no legal basis to process Norwegian Grindr users' personal data.
The Borgarting Court of Appeal had in 2024 (Case LB-2024-154313) held that being a Grindr user itself indicates sexual orientation and therefore constitutes special category data under Article 9(1) GDPR. Explicit consent under Article 9(2)(a) was thus the relevant basis for Xandr's processing as a joint controller. Xandr argued that its contract with Grindr made Grindr solely responsible for obtaining consent.
Our ref: Doc No. 2/2
The Authority rejected that argument. Controllers may agree that one collects consent for the other, but this discharges the other's obligations only if both ensure compliance with Articles 4(11) and 7 GDPR. Such agreements do not remove either controller's responsibility under Article 9. Under Articles 5(2) and 24, both must ensure that consent is documented and covers their respective processing. The consent obtained by Grindr did not meet the requirements of Article 4(11), and Xandr did not verify its validity or whether it covered Xandr's own processing. Xandr was therefore jointly responsible for breaching Articles 6(1) and 9(1) GDPR.
Several aggravating factors informed the decision to fine Xandr and the amount. The Authority noted that the infringement lasted nearly two years and that Xandr had not verified Grindr's consent, although the processing was central to its business. It also emphasised that the data revealed sexual orientation, a specially protected category whose disclosure could endanger users' rights and freedoms. The Authority further found that Xandr must have benefited financially, an aggravating factor under Article 83(2)(k) GDPR.
Xandr argued that neither it nor comparable companies could reasonably have foreseen the legal standards applied. Treating this as reliance on industry practice, the Authority rejected it. Citing the Borgarting Court of Appeal's judgment in the underlying Grindr case, it held that treating industry practice during the relevant period as mitigating would undermine fines' deterrent effect. Widespread non-compliance instead reinforced the need for deterrence.

Conclusion

CONCLUDING REMARKS
The Xandr decision confirms that liability for unlawful processing of personal data cannot be fully outsourced.
Each controller remains individually accountable under Articles 5(2) and 24 GDPR, regardless of contractual delegation. If one collects consent, both must ensure that it validly covers their respective processing.
Indirect identifiers can also constitute special category data: sharing the app name with an advertising ID and IP address revealed sexual orientation under Article 9(1) GDPR, although none was sensitive alone.
Widespread industry non-compliance is not mitigating. It reinforces the need for deterrent fines; accepting it as an excuse would undermine their purpose.
Financial benefit from unlawful processing weighs heavily in favour of a fine, as non-pecuniary measures cannot offset economic gain.
A prolonged infringement involving a core business activity weighs heavily in assessing severity and can itself justify a substantial fine.

Article provided by INPLP members: Anne-Marit Wang and Kine Emilie Helgeneseth (Selmer, Norway)