Written by: Haim Ravia, Dotan Hammer
On October 2, 2026, the Norwegian Data Protection Authority (Datatilsynet) issued a final decision fining Xandr Inc., the advertising technology company formerly known as AppNexus and now part of Microsoft, NOK 92 million (approximately EUR 8.6 million) for unlawfully processing personal data of users of the Grindr dating app in real-time bidding for advertising. The decision found that Xandr violated Article 6(1) of the General Data Protection Regulation (GDPR) by processing personal data without a legal basis, and Article 9(1) of the GDPR by processing data concerning users’ sexual orientation without a valid exemption.
The decision is the latest chapter in a case that began in 2020, when the Norwegian Consumer Council lodged complaints with Datatilsynet against Grindr and several of its advertising technology partners, including Xandr. In January 2021, Datatilsynet announced its intention to fine Grindr for sharing users’ personal data with third parties for advertising without a legal basis. In that case, the regulator found that Grindr’s consents were invalid because users were required to accept the privacy policy in its entirety, were not asked specifically about the sharing of their data, and were not properly informed. Datatilsynet also held that the mere fact that a person uses Grindr, an app aimed at gay, bi, trans and queer people, indicates that person’s sexual orientation and therefore constitutes special category data. At the time, Xandr was among the advertising partners against which complaints remained pending.
In the Xandr decision, Datatilsynet found it proven by clear preponderance of probability that, in the course of real-time bidding for advertising served in the Grindr app, Xandr processed at least the fact that individuals were using Grindr, their advertising ID, and their IP address. These data constitute personal data under Article 4(1) GDPR, and the fact that a person uses Grindr constitutes data concerning sexual orientation under Article 9(1) GDPR. Xandr acted in the bidding process both as a supply-side platform and as a demand-side platform, and the regulator found it to be a joint controller for the processing in both capacities.
The central legal question was whether Xandr could rely on consent collected by Grindr. Xandr did not obtain consent itself but relied on the consent that Grindr obtained from its users, which Datatilsynet had already found invalid under Articles 4(11) and 7 GDPR. Because the data revealed sexual orientation, the only relevant exemption under Article 9(2)(a) GDPR was explicit consent, and no valid exemption applied. Datatilsynet held that each joint controller must independently verify that consent is valid and covers its own processing, stating that accountability cannot be outsourced. The regulator classified the infringements as at least negligent and of high seriousness, given that they concern central provisions of the GDPR and sensitive personal data.
Click here to read the Norwegian Data Protection Authority’s announcement of the decision.
