Xandr: an ad intermediary must verify consent for its own use of sensitive data
Datatilsynet fined Xandr NOK 92 million over Grindr users' data in real-time bidding. Relying on the publisher to obtain consent did not establish Xandr’s own legal basis.
The problem
An advertising recipient needs evidence that a user’s permission covers that recipient’s processing. Passing a consent signal through a chain does not establish this on its own.
kr 92m
- Regulator or court
- Norwegian Data Protection Authority (Datatilsynet)
- Jurisdiction
- Norway / EEA
- Framework
- GDPR Articles 6 and 9
- Decision
- Procedural status
- Administrative decision; announcement states a three-week appeal period
Sensitive context in event data · Undisclosed data exchanges · Notice, consent scope and assent
Case record
- Norwegian Data Protection Authority (Datatilsynet)
- Norway / EEA
- GDPR Articles 6 and 9
- 2 October 2026
- NOK 92,000,000
- Administrative decision; announcement states a three-week appeal period
- 19 October 2026
Primary record: Datatilsynet announcement.
What the authority found
Datatilsynet found that Xandr processed Grindr users' data during real-time bidding without a valid legal basis or an applicable exception for special-category data. The authority treated use of Grindr as information concerning sexual orientation. Datatilsynet announcement.
Xandr relied on Grindr’s collection of consent. The authority found that it had not verified valid consent for its own processing and regarded Xandr as a joint controller. The case concerns conduct from July 2018 to April 2020. Authority notice on EDPB.
Outcome and limits
The recorded fine is NOK 92,000,000. The authority also reports a euro equivalent, but this library retains the original Norwegian-kroner amount. Its announcement permits an appeal within three weeks of receipt; this record does not establish an appeal outcome or payment. Datatilsynet announcement.
Checks for your own systems
These are implementation checks suggested by Inth, not additional findings about the company.
- Inventory every advertising recipient and onward-sharing route, including mobile SDKs and server-side auctions.
- Keep the purpose, recipient and version of the collection notice with evidence of the permission relied on.
- Have the responsible team assess special-category data and each recipient’s legal basis before enabling an integration.
How Inth helps
Code audit can flag new advertising dependencies and trace reviewed outbound data flows. Website audit can record observable browser requests and the consent state when they occur.
A browser observation cannot establish downstream auction recipients, valid explicit consent or a partner’s legal basis. Those need recipient records, contracts and legal review.
Sources and limits
Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.