Norway’s data protection authority has fined Microsoft-owned adtech firm Xandr NOK 92 million for passing Grindr users’ data through real-time ad auctions without a lawful basis. Its core finding, that an intermediary cannot rely on someone else’s consent screen, applies directly to UK organisations that share data with adtech and other third parties.
What happened
On 12 October 2026 Datatilsynet, the Norwegian Data Protection Authority, announced an administrative fine of NOK 92 million against Xandr, the advertising technology business that was known as AppNexus when the complaint was made and is now part of Microsoft. The regulator puts the figure at roughly €8.6 million and says it is the largest penalty it has ever imposed.
The Norwegian Consumer Council complained in 2020, working with privacy group noyb. The case concerns how data about people using Grindr, a location-based dating app for gay, bi, trans and queer people, flowed out to the advertising market. According to Datatilsynet, between July 2018 and April 2020 Xandr passed that information on to what may have been thousands of ad buyers, without any legal basis.
Xandr’s defence was simple: it had assumed Grindr collected valid consent. The regulator rejected that argument outright, found Xandr to be a joint controller alongside Grindr, and said the company had done nothing to check whether the consent it was relying on was valid. Director General Line Coll summarised the message bluntly: “responsibility for data protection cannot be passed on to others.” Xandr can appeal within three weeks of receiving the decision; no statement from Microsoft or Xandr accompanied the announcement.
The detail
The mechanism at the heart of the decision is real-time bidding (RTB). An app with advertising space sends a bid request carrying user information to an exchange, which copies it to connected bidders who decide within milliseconds whether to buy the impression. Xandr worked on both the sell and buy sides, putting it at the point where one request is multiplied across the market.
The sensitivity of the data is what turned a routine adtech flow into a serious breach. Datatilsynet’s position, already backed by the Borgarting Court of Appeal when Grindr itself was fined NOK 65 million for equivalent breaches, is that the mere fact someone uses Grindr reveals their sexual orientation. That puts the data in the special category tier of the GDPR, which in this context requires explicit consent.
Three factors pushed the amount up, according to the regulator: Xandr’s position as a major player whose business model is built on processing personal data, the direct financial benefit it gained from the unlawful sharing, and the near two-year duration of the conduct. Because the conduct predates the acquisition, the authority based the amount on Xandr’s turnover, not Microsoft’s. PPC Land notes the penalty is about 42 per cent larger than Grindr’s.
PPC Land also points to the March 2026 ruling of France’s Conseil d’Etat upholding Criteo’s €40 million fine: the French court said proof of valid consent remains the controller’s job even where a partner gathered it. The same “our partner handled consent” argument has now failed in two jurisdictions.
Why it matters for UK organisations
Norway is bound by the GDPR via the EEA rather than the EU, and this is not a UK decision and it does not bind the UK regulator. It would be a mistake to treat it as foreign noise, though. The UK GDPR keeps the same building blocks the Norwegian authority relied on: the special category rules that demand explicit consent or another Article 9 condition, the joint controller provisions, and the accountability principle that requires each controller to be able to demonstrate compliance rather than simply assert it.
The lesson goes well beyond dating apps. Any UK organisation running advertising SDKs, third-party tags or bought-in audiences sits in a similar chain. Where the app itself implies something sensitive, such as health, religion or sexuality, PPC Land argues that its identifier in a bid request may carry that sensitivity on its own.
The obligation runs in both directions: publishers and intermediaries each need their own lawful basis and evidence of it. For UK boards that have treated adtech as a marketing matter, this is a governance and third-party risk issue that belongs on the same register as any other supplier processing personal data.
Expert view
In my experience, the data flows that get organisations into trouble are rarely the ones in the architecture diagram. When we test mobile apps and websites, it is common to find SDKs and tags transmitting device identifiers, location and context to parties the client cannot name, and in some cases did not know were there.
What makes this decision useful is how plainly it describes the failure. Xandr did not verify, did not document and did not ask questions, and it made money while it did not. I see the same pattern across supplier assurance: contracts and framework signals are treated as proof when they are only claims. A consent string tells you a banner was shown. It does not tell you the consent meets the standard required for special category data.
It is also worth noting the timescale. These breaches ended in 2020 and the fine arrived in 2026, and the authority used the turnover of the business at the time rather than its later owner. Acquirers should treat historic processing and open complaints as part of due diligence. Noyb’s lawyer Felix Mikolasch, quoted by PPC Land, called it “a valuable precedent for similar cases”, and I would expect complainants to cite it.
What to do now
- Map your third-party data flows. Inventory every SDK, pixel and tag in your apps and sites, and capture real traffic to confirm what actually leaves the device. This builds on the asset and software inventory that underpins Cyber Essentials secure configuration.
- Flag sensitive context. Identify any service whose use could itself reveal special category data, and stop sharing identifiers from those contexts with advertising partners unless you have a documented Article 9 condition.
- Verify, do not assume, consent. If you rely on a partner’s consent, obtain evidence of how it was collected and test that it meets the standard you need. If you are the collector, confirm downstream parties can rely on it.
- Review controller roles and contracts. Revisit data sharing and joint controller arrangements so responsibilities are explicit, and make sure each party can demonstrate its own lawful basis.
- Bring adtech into supplier risk management. Apply the same due diligence, audit rights and periodic review to marketing technology vendors as you would to any processor, and remove unused tags as part of routine configuration hygiene.
Bottom line
Datatilsynet has put a record price on a familiar excuse. An intermediary that profits from personal data cannot point at the app that collected it and claim the consent problem belongs to someone else. UK organisations working under the same legal principles should assume the same logic would be applied here, and should be able to show, not merely state, that every party in their data chain has a lawful basis for what it does.
