The Norwegian supervisory authority's €8.6 million fine against Xandr highlights a critical compliance issue for companies in multi-party data ecosystems: you can't outsource your verification obligations to your partners.
What Changed
Between July 2018 and April 2020, Xandr processed and distributed Grindr users' personal data through real-time bidding auctions without establishing its own lawful basis. The company assumed Grindr had obtained valid consent. The Norwegian supervisory authority rejected this assumption, designated Xandr as a joint controller with Grindr, and imposed the authority's largest fine to date.
This decision clarifies that operating in the background of an advertising supply chain doesn't exempt you from controller responsibilities. If you determine purposes and means of processing alongside another party, you're a joint controller under Article 26. That designation carries independent compliance obligations you must fulfill regardless of what your partner claims to have done.
Key Findings
Joint controllership triggers independent verification duties
The authority found Xandr qualified as a joint controller because it participated on both sides of real-time bidding, determining how user data flowed through the advertising ecosystem. This wasn't a processor relationship where Xandr simply followed Grindr's instructions. Xandr made its own decisions about data distribution, auction mechanics, and which parties received user information.
Under Article 26, joint controllers must determine their respective responsibilities through a transparent arrangement. More critically, each controller remains independently liable for compliance. You can't point to your partner's consent mechanism and consider your obligations satisfied.
Special category data requires explicit consent, not assumptions
The supervisory authority concluded that being identified as a Grindr user reveals sexual orientation, qualifying the data as special category under Article 9. Processing special category data requires meeting one of Article 9(2)'s conditions, with explicit consent being the most common path for advertising use cases.
Xandr argued it believed Grindr had obtained consent. The authority found this belief insufficient. Explicit consent for special category data requires documented verification, not contractual assurances. Your due diligence must extend beyond a partner's representations to examine the actual consent mechanism, its specificity, and whether it covers your processing activities.
Real-time bidding creates visibility and control problems
The decision highlights how real-time bidding distributes personal data to potentially thousands of companies in fractions of a second. Users opening an app trigger automated auctions where their information gets shared with advertisers who need it to evaluate bidding opportunities.
This process creates two compliance challenges. First, the speed and scale make it nearly impossible for users to understand where their data goes. Second, once data enters the bidding stream, the original controller loses practical control over subsequent use. These characteristics don't eliminate your obligations; they intensify your responsibility to establish proper safeguards before processing begins.
Duration and financial benefit increase penalties
The authority considered the nearly two-year violation period and Xandr's direct financial benefit from the unlawful sharing when calculating the penalty. The fine used Xandr's standalone turnover because the violations predated Microsoft's ownership, but the calculation methodology shows supervisory authorities examining both the duration of non-compliance and whether you profited from it.
What This Means for Your Team
If you're receiving data from partners in advertising, analytics, or other multi-party ecosystems, you need documented evidence of lawful basis, not contractual warranties. Your partner's privacy notice and consent flow are your concern because you're potentially a joint controller.
The joint controllership designation doesn't require equal responsibility for all processing aspects. You and your partner can allocate specific obligations through your Article 26 arrangement. However, allocation doesn't eliminate liability. If your partner's consent mechanism fails, supervisory authorities can pursue either or both controllers.
For special category data, your verification standard rises. You must examine whether consent is explicit, specific to the processing activity, freely given, and documented. A general statement in your data processing agreement that "Partner warrants it has obtained all necessary consents" won't satisfy Article 9's requirements.
Action Items by Priority
Immediate: Map your joint controller relationships
Review every data sharing arrangement where you and another party jointly determine processing purposes or means. This includes advertising platforms, analytics providers, and co-marketing partnerships. Document which party handles which obligations, particularly consent collection, transparency, and data subject rights.
Your Article 26 arrangement must be transparent and available to data subjects. If you're distributing responsibility for DSARs, your arrangement should specify which controller handles initial requests and how you'll coordinate responses within the one-month deadline.
Within 30 days: Audit partner consent mechanisms
For relationships involving special category data, examine your partner's actual consent implementation. Review the consent language, timing, granularity, and withdrawal mechanism. Verify that consent covers your specific processing activities, not just your partner's.
If you're processing based on legitimate interests instead of consent, conduct your legitimate interests assessment independently. Don't rely on your partner's assessment unless you've jointly documented the legitimate interests assessment and can demonstrate compatible interests.
Within 90 days: Implement verification checkpoints
Build verification into your partner onboarding and ongoing compliance monitoring. Before processing data from a new partner, require evidence of their lawful basis. For consent-based processing, this means reviewing consent text, examining implementation, and confirming users can withdraw.
For existing partners, establish quarterly or annual compliance reviews. Request updated evidence of consent validity, particularly after the partner changes their privacy notice or consent flow. Document these reviews and your verification findings.
Ongoing: Strengthen transparency for multi-party processing
If you're operating in real-time bidding or similar automated ecosystems, examine whether your transparency obligations under Articles 13 and 14 adequately inform users about downstream data sharing. The Norwegian authority emphasized that users had little visibility into where their information went or how it could be used.
Your privacy notice should identify categories of recipients with enough specificity that users understand the scope of sharing. "Advertising partners" may not suffice when you're distributing data to thousands of companies through automated auctions.
