Skip to content
PrivacyBuilt

Regulatory Pulse

Datatilsynet fines Xandr NOK 92 million over sensitive advertising data

The decision highlights independent consent verification and accountability across advertising supply chains.

Norway / GDPR
Sensitive data, consent, adtech and vendor accountability
Guidance
Official source reviewed

PrivacyBuilt Editorial · Source published Official enforcement decision · Reviewed 13 October 2026 · 6 min read

LinkedInShare on X WhatsApp

The 60-second summary

On 12 October 2026, Datatilsynet announced a NOK 92 million fine against Xandr for unlawful processing of Grindr users' data. The decision is dated 2 October. It concerns July 2018–April 2020 and finds violations of GDPR Articles 6(1) and 9(1), including processing information revealing sexual orientation. The authority found joint controllership and rejected reliance on unverified upstream consent. This is an administrative decision with an appeal route, not a new law or final judicial outcome.

Timeline that matters

  1. July 2018–April 2020

  2. 2 October 2026

  3. 12 October 2026

  4. Three weeks after receipt

  5. 20 October 2026

What changed

A newly announced enforcement decision addresses accountability across real-time bidding.The regulator found that each joint controller must verify valid consent covering its own processing.

Who should care

Advertising platforms and publishersApp, SDK and marketing technology ownersSensitive-data discovery and privacy teamsProcurement, vendor-risk and legal specialists

Why this matters for global organisations.

Ordinary identifiers can reveal sensitive information when linked to service context. Every participant needs a defensible purpose, a verified permission trail and visibility into downstream disclosure.

13 actions to start now

  1. Map advertising data from collection to each onward recipient.
  2. Identify contextual signals that can reveal sensitive attributes.
  3. Record purposes and role determinations for each processing stage.
  4. Review legal bases and special-category conditions with counsel.
  5. Obtain versioned consent evidence covering actual recipients and uses.
  6. Test the connection between consent choices and outbound data flows.
  7. Use synthetic accounts to check whether declined or withdrawn choices stop disclosures.
  8. Inspect SDK and bid-request payloads through authorised, privacy-preserving testing.
  9. Review joint-controller arrangements against actual decisions and data flows.
  10. Set contractual evidence requirements and audit responsibilities for suppliers.
  11. Restrict sensitive contextual signals and unnecessary identifiers in exports.
  12. Rehearse withdrawal, deletion and incident escalation across parties.
  13. Retain testing and approval evidence; reassess when recipients or purposes change.

Evidence worth retaining

  • Flow and recipient inventory
  • Contextual sensitivity assessment
  • Role and legal-basis decisions
  • Versioned notices and consent provenance
  • Synthetic payload and withdrawal test results
  • Supplier assessments and controller arrangements
  • Change approvals and remediation evidence

Questions to take to counsel or your conformity team

These are discussion prompts, not legal advice or conclusions.

  • Can identifiers and service context reveal a protected attribute?
  • Does permission evidence cover our own purpose and recipients?
  • Are actual decisions consistent with controller and processor labels?
  • Which evidence can we obtain without collecting unnecessary user information?
  • What official appeal developments would change our interpretation?

Official sources

PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.

PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.

LinkedInShare on X WhatsApp