Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data

What happened

The Norwegian DPA fined Xandr Inc EUR 8.6 million for unlawful processing of personal and special category data of Grindr users in Norway. The investigation began after a 2020 complaint by the Norwegian Consumer Council. Xandr acted as a joint controller in real‑time bidding, relying on Grindr's consent, which the DPA deemed invalid. The fine cites breaches of GDPR Articles 6(1) and 9(1). The regulator highlighted the seriousness due to the sensitive nature of the data.

Why it matters

Other ad‑tech firms acting as joint controllers must independently verify that any consent they rely on meets GDPR standards, especially for special‑category data, or risk similar penalties.

Business impact

Failure to secure valid consent can lead to substantial fines and damage to reputation, prompting firms to overhaul consent management and joint‑controller agreements.

Checklist

• Audit joint‑controller consent processesHigh priority

  Confirm that each controller independently validates consent for its own processing activities.

• Map real‑time bidding data flowsHigh priority

  Identify all personal and special‑category data shared and ensure lawful bases are documented.

• Update contracts with partnersMedium priority

  Include clauses requiring partners to provide verifiable consent for special‑category data.

• Implement explicit consent mechanismsCritical priority

  Obtain separate, documented consent from users for processing sexual orientation data.

Who reported it

Discussion