Xandr fine: consent is not an assumption

The partner has already collected consent. Advertising technology provider Xandr relied on that assumption. Norway’s Data Protection Authority did not accept it: the authority imposed a NOK 92 million fine, approximately EUR 8.6 million according to its announcement, over the processing of Grindr users’ personal data in Norway.

The authority announced the fine on 12 October 2026. The case raises a question extending beyond one advertising service: who checks whether permission claimed elsewhere in a data supply chain actually covers their own processing?

What the Xandr fine concerns

The decision dated 2 October concerns conduct between July 2018 and April 2020. This is not a report of a new cyberattack. Xandr is now part of Microsoft, but was not part of the group during the period investigated.

The case centres on real-time bidding: automated auctions for advertising space. The authority describes data travelling from the Grindr app through intermediary MoPub to Xandr. Within the advertising ecosystem investigated, information could potentially reach thousands of further companies.

According to the authority’s findings, Xandr processed at least advertising IDs, IP addresses and the fact that a person used Grindr. That context matters: the authority classifies it as information concerning sexual orientation, a specially protected category of personal data.

Why relying on a partner’s consent was insufficient

The European Data Protection Board’s summary explains that Xandr was considered a joint controller on both the supply and demand sides. Explicit consent was required for the processing of the special category of data in this case.

Xandr did not obtain consent itself, instead relying on consent collected by Grindr. The authority assessed that consent as invalid. It found that Xandr had not adequately verified whether valid consent covered its processing. The sanction concerns infringements of Article 6(1) and Article 9(1) GDPR.

Joint responsibility did not entitle Xandr to rely on the other party’s checks. What matters is the processing actually covered, rather than an assurance that a consent dialogue exists somewhere in the chain.

What companies can take from the decision

Our view: companies receiving data from a service provider or business partner should be able to explain the data flow and their own role. A contract does not automatically answer those questions. Three practical starting points for an internal review are:

This does not mean that every processing activity requires consent. The legal basis, special categories of data and the participants’ roles require separate assessment. The Xandr case illustrates why that review cannot simply stop at a system boundary.

For organisational implementation, our article on ISO 27001 and privacy connects responsibilities, measures and evidence. Our supplier risk management guide covers ongoing business-partner reviews. The technical use of web analytics is a separate subject, addressed in our Matomo privacy article.

The procedural status matters

The published decision provides a three-week appeal period from receipt. The authority sources reviewed here do not confirm the subsequent conclusion of an appeal process. The fine is therefore presented as an administrative decision, rather than a final court judgment.

The practical implication remains: a data supply chain needs verifiable responsibilities. A partner’s assurance is not evidence of your own review.