Severity: Info Other, enforcement EU
Norwegian DPA fines Xandr EUR 8.6 million for unlawful processing of personal data
Original title: Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
- Published
- Source: edpb.europa.eu
- Effective
- Not stated
- Deadline
- Not stated
- Framework: GDPR
- Regulation (EU) 2016/679 (as corrected 2018) source
- in 14 days
- Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source
Why it matters
The Norwegian DPA has fined Xandr Inc. EUR 8.6 million for unlawfully processing personal data of Grindr users, including advertising IDs, IP addresses, and sexual orientation data during real-time bidding. Xandr acted as a joint controller but failed to independently verify that users' consent was valid under Articles 6 and 9 of the GDPR, instead relying on Grindr's invalid consent. This decision establishes that joint controllers cannot outsource accountability for consent verification and must independently confirm that consent covers their own processing activities.
What changed
- Norwegian DPA imposed EUR 8.6 million administrative fine on Xandr Inc. for violations of Article 6(1) GDPR (lawfulness of processing) and Article 9(1) GDPR (processing of special category data).
- Joint controllers are held accountable for independently verifying validity of consent; reliance on another controller's consent without verification does not satisfy GDPR requirements.
- Processing of special category data (sexual orientation) requires explicit consent under Article 9(2)(a); implicit or indirect consent through a third party is insufficient.
- Real-time bidding processing of users' location, device identifiers, and sexual orientation data constitutes processing of special category personal data requiring heightened legal basis.
Who is affected
Advertising technology companies operating as supply-side or demand-side platforms; online platforms processing users' data for real-time bidding; any joint controller processing special category data
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.