[Enforcement library](/enforcement)

# Xandr: an ad intermediary must verify consent for its own use of sensitive data

Datatilsynet fined Xandr NOK 92 million over Grindr users' data in real-time bidding. Relying on the publisher to obtain consent did not establish Xandr's own legal basis.

## Key facts

- **Regulator or court:** Norwegian Data Protection Authority (Datatilsynet)
- **Jurisdiction:** Norway / EEA
- **Framework:** GDPR Articles 6 and 9
- **Record date:** 2026-10-02
- **Procedural status:** Administrative decision; announcement states a three-week appeal period

Datatilsynet fined Xandr NOK 92 million over Grindr users' data in real-time bidding. Relying on the publisher to obtain consent did not establish Xandr's own legal basis.

Norwegian Data Protection Authority (Datatilsynet) · GDPR Articles 6 and 9 · Decision: 2 October 2026

## The problem

An advertising recipient needs evidence that a user's permission covers that recipient's processing. Passing a consent signal through a chain does not establish this on its own.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Norwegian Data Protection Authority (Datatilsynet) |
| Jurisdiction | Norway / EEA |
| Law | GDPR Articles 6 and 9 |
| Decision date | 2 October 2026 |
| Recorded fine | NOK 92,000,000 |
| Procedural status | Administrative decision; announcement states a three-week appeal period |
| Source review | 19 October 2026 |

Primary record: [Datatilsynet announcement](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/).

## What the authority found

Datatilsynet found that Xandr processed Grindr users' data during real-time bidding without a valid legal basis or an applicable exception for special-category data. The authority treated use of Grindr as information concerning sexual orientation. [Datatilsynet announcement](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/).

Xandr relied on Grindr's collection of consent. The authority found that it had not verified valid consent for its own processing and regarded Xandr as a joint controller. The case concerns conduct from July 2018 to April 2020. [Authority notice on EDPB](https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en).

## Outcome and limits

The recorded fine is NOK 92,000,000. The authority also reports a euro equivalent, but this library retains the original Norwegian-kroner amount. Its announcement permits an appeal within three weeks of receipt; this record does not establish an appeal outcome or payment. [Datatilsynet announcement](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Inventory every advertising recipient and onward-sharing route, including mobile SDKs and server-side auctions.
- Keep the purpose, recipient and version of the collection notice with evidence of the permission relied on.
- Have the responsible team assess special-category data and each recipient's legal basis before enabling an integration.

## How Inth helps

Code audit can flag new advertising dependencies and trace reviewed outbound data flows. Website audit can record observable browser requests and the consent state when they occur.

A browser observation cannot establish downstream auction recipients, valid explicit consent or a partner's legal basis. Those need recipient records, contracts and legal review.

## Sources and limits

- [Datatilsynet announcement](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/)
- [Authority notice on EDPB](https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.