Norway Fines Xandr NOK 92 Million Over Unlawful Sharing of Grindr Users' Sensitive Data

Key Takeaways

• The Norwegian Data Protection Authority has issued its largest-ever fine—NOK 92 million (€8.6 million)—against Microsoft-owned ad-tech company Xandr for unlawfully processing and sharing sensitive personal data, including sexual orientation data derived from Grindr app usage, through real-time bidding.
• The decision reinforces that joint controllers cannot shift data protection responsibility to counterparties and underscores heightened regulatory scrutiny of the ad-tech ecosystem's handling of special category data.

Deep Dive

This enforcement action is a significant signal to compliance teams across the ad-tech, data broker, and digital advertising sectors that regulators are prepared to impose severe penalties for failures in verifying lawful basis for processing special category data, even when the entity did not directly collect the data. The Norwegian DPA found Xandr to be a joint controller alongside Grindr and held that Xandr could not rely on Grindr's claimed consent without independently verifying its validity. This "pass-the-buck" defense was explicitly rejected, establishing a clear precedent that each party in a data-sharing chain bears independent accountability.

Key requirements highlighted include the necessity of explicit, verifiable consent when processing special category data (such as data inferring sexual orientation), the obligation for joint controllers to independently document their lawful basis, and heightened scrutiny of real-time bidding (RTB) practices given their inherent opacity and scale of data dissemination. The regulator emphasized that reliance on contractual assurances from a data-sharing partner is insufficient; companies must conduct their own due diligence and maintain documentary evidence of lawful processing.

Timeline-wise, the infringing conduct occurred between July 2018 and April 2020, with the regulatory investigation originating from a 2020 complaint by the Norwegian Consumer Council. Xandr has three weeks from receipt of the decision to appeal, meaning the fine is not yet final and could be contested. Notably, the fine was calculated based on Xandr's standalone turnover during the infringement period rather than Microsoft's consolidated turnover, since Xandr was acquired by Microsoft after the relevant period—an important point for M&A due diligence teams assessing successor liability risk.

For compliance professionals, recommended actions include: (1) conducting comprehensive audits of RTB and ad-tech data flows to confirm lawful basis documentation at each stage of the supply chain; (2) revisiting joint controller agreements to ensure independent verification mechanisms rather than blind reliance on partner representations; (2) enhanced scrutiny of consent collection mechanisms for apps processing special category data; (4) reviewing historical M&A transactions involving ad-tech targets for potential inherited liability; and (5) monitoring the appeal outcome, as it may clarify standards for joint controller liability allocation. The reputational and financial risk is compounded by the sector-wide implications—this ruling, alongside the 2021 Grindr fine, signals sustained regulatory focus on LGBTQ+ data sensitivity and the advertising ecosystem broadly, suggesting more enforcement actions against other ad-tech intermediaries may follow.

Source: Norwegian Data Protection Authority