The Challenge
Between July 2018 and April 2020, Xandr processed personal data revealing the sexual orientation of Grindr users in Norway without confirming it had a lawful basis to do so. The Norwegian supervisory authority found that Xandr acted as a joint controller with Grindr, sharing responsibility for legal data processing. However, Xandr assumed Grindr obtained proper consent without any verification or documentation of responsibilities.
The scale of the violation was significant. Xandr, acting as an intermediary in real-time bidding, relayed Grindr users' data to potentially thousands of companies. Each time a user opened the app, their personal data was shared with advertisers who could bid for targeted ad placement. Users were unaware, and their data moved through the supply chain without meaningful consent.
The Environment and Constraints
Real-time bidding presents a compliance challenge for joint controllers. Data moves in milliseconds. When a user opens an app, their profile data is broadcast to numerous advertisers almost instantly. In this setup, Xandr faced several constraints:
First, the technical architecture separated Xandr from direct user interaction. Grindr collected the data, and Xandr processed and distributed it. This separation made it easy to assume the other party handled consent.
Second, Xandr operated on both the buy and sell sides of the advertising ecosystem. It wasn't just a passive conduit. The Norwegian authority noted this dual role as central to the infringement because Xandr actively participated in determining how the data would be used.
Third, the violations occurred shortly after GDPR enforcement began. The infringements started in July 2018, just two months after GDPR took effect. Many companies were still figuring out how Article 26 applied to complex data-sharing arrangements.
Despite these constraints, Xandr's fundamental failure was processing special category data under Article 9 without explicit consent or another valid lawful basis.
The Approach Taken
Xandr's approach was to rely on Grindr. When investigated, Xandr argued it assumed the dating app had collected users' consent. This assumption replaced actual due diligence.
The company didn't establish a joint controllership arrangement under Article 26(1), which requires controllers to determine their respective responsibilities for GDPR compliance. It didn't verify that Grindr's consent mechanism met Article 7's requirements. It didn't confirm that users understood their data would be shared with third parties through real-time bidding. It didn't implement technical controls to check for valid consent signals before processing the data.
Instead, Xandr relied on contractual distance and technical intermediation to create plausible deniability. If Grindr collected the data and fed it into the bidding system, surely Grindr must have handled consent properly.
The Norwegian authority rejected this reasoning. Joint controllership means joint responsibility. When you determine the purposes and means of processing alongside another controller, you can't outsource your compliance obligations through assumptions.
Results and Metrics
The Norwegian supervisory authority imposed an €8.6 million fine, the largest penalty it has issued. The authority described the infringement as "very serious" and calculated the fine based on Xandr's total annual turnover during the two-year violation period.
Thousands of Grindr users in Norway had their sensitive data unlawfully shared. The authority emphasized that the data revealed sexual orientation, which receives heightened protection under Article 9 as special category data.
Beyond the financial penalty, the reputational cost is significant. The Norwegian consumer council and privacy non-profit noyb filed the original complaint in 2020, generating sustained public attention to Xandr's practices. Noyb described the fine as a "major blow for the online advertising and commercial surveillance industry."
Microsoft, which acquired Xandr in late 2021 and later consolidated it under the Microsoft Ads brand in June 2023, now owns this enforcement action. The company told Reuters it's reviewing the decision and assessing its options.
What They Would Do Differently
A functioning joint controllership arrangement would have changed everything. Article 26(1) requires joint controllers to determine their respective responsibilities, particularly for exercising data subject rights and providing information under Articles 13 and 14.
Xandr should have established with Grindr who would obtain consent, what that consent would cover, and how both parties would verify its validity before processing. This arrangement needed to be documented and made available to users.
Second, Xandr needed independent verification that consent existed before processing special category data. You can't process Article 9 data based on another controller's assurances. You need technical controls that check for valid consent signals at the point of processing.
Third, the company should have conducted a legitimate interests assessment to determine whether real-time bidding was appropriate for data revealing sexual orientation. Special category data requires explicit consent under Article 9(2)(a), and that consent must be specific, informed, and freely given. Users opening a dating app don't expect their sexual orientation to be shared with thousands of advertisers.
Takeaways for Your Team
If you're processing personal data with another controller, Article 26 applies to you. Don't assume the other party handled consent or established a lawful basis. Verify it. Document it. Build technical controls that enforce it.
Joint controllership arrangements aren't optional legal paperwork. They're operational requirements. Your arrangement must specify who handles data subject access requests, who provides transparency information, and who obtains consent when it's required. Make this arrangement available to users.
When you're processing special category data, your compliance bar is higher. Article 9 prohibits processing unless you meet one of the narrow exceptions. Explicit consent is the most common exception, but it must be genuinely explicit. Pre-ticked boxes don't work. Buried terms don't work. Assumptions about what another controller obtained definitely don't work.
Real-time bidding creates structural compliance problems that you can't solve with better contracts. If your business model requires broadcasting special category data to thousands of parties in milliseconds, you're operating in a regulatory minefield. The Norwegian authority made clear that technical complexity doesn't excuse legal violations.
Finally, supervisory authorities are scrutinizing data-sharing ecosystems more closely. The €8.6 million fine signals that intermediaries can't hide behind their position in the supply chain. If you determine purposes and means of processing, you're a controller. If you do that jointly with another party, you're a joint controller. Your compliance obligations follow from that status, not from your commercial agreements.
