Norwegian DPA fine puts adtech consent chains under scrutiny after an advertising intermediary relied on invalid consent to process sensitive data during real-time bidding.
The Norwegian Data Protection Authority (Datatilsynet) has fined advertising technology company Xandr NOK 92 million, approximately EUR 8.6 million, for unlawfully processing and sharing personal data relating to Grindr users in Norway. The regulator found that Xandr acted as a joint controller within the real-time bidding ecosystem and could not rely on consent obtained by another participant without independently verifying that it was valid and covered Xandr’s own processing.
The decision, also reported by the European Data Protection Board, found infringements of Article 6(1) GDPR because there was no lawful basis for the processing and Article 9(1) because data concerning sexual orientation were processed without a valid exception. Datatilsynet described the infringements as highly serious and said the fine was the largest it had issued.
The case arose from real-time bidding involving dating app user data.
The investigation began after the Norwegian Consumer Council complained in 2020 about the participation of Xandr, then known as AppNexus and now part of Microsoft, in advertising on Grindr. Real-time bidding allows advertising space to be auctioned automatically in a fraction of a second. Information about a user is transmitted through platforms so that advertisers can decide whether and how much to bid for an opportunity to display an advert.
Datatilsynet found that Xandr processed at least the fact that individuals used Grindr, together with advertising identifiers and IP addresses. In many cases, the data were relayed through Xandr to potentially thousands of actors in the advertising ecosystem. The regulator considered both Xandr’s supply-side and demand-side activities and concluded that it was a joint controller for the relevant processing.
Use of the app was itself treated as data concerning sexual orientation.
A significant feature of the decision is that the sensitive inference did not depend on a user expressly stating their sexual orientation. Datatilsynet treated the fact that a person used Grindr, a location-based dating app aimed at gay, bi, trans and queer people, as information indicating sexual orientation and therefore as special category data under Article 9 GDPR.
This has wider implications for digital advertising and analytics. An app, website, community, location or content category can reveal or strongly imply sensitive characteristics even where the data fields transmitted appear technical. Controllers must assess the context and what information can be inferred when identifiers, IP addresses, app usage and other signals are combined.
Explicit consent was required but the advertising intermediary did not verify that it was valid.
Because the processing involved special category data, Datatilsynet concluded that explicit consent under Article 9(2)(a) was the relevant condition. Xandr did not obtain consent directly. Instead, it relied on consent collected by Grindr, which the regulator found did not satisfy the GDPR requirements for valid consent.
Xandr argued that Grindr was responsible for obtaining consent, but the authority rejected the idea that participants could pass responsibility through the advertising chain. Each controller must be able to demonstrate that the consent on which it relies is valid, sufficiently informed and specific, and that it covers the controller’s own purposes and processing operations.
Joint controllership makes independent accountability essential.
The finding of joint controllership is central to the enforcement message. Organisations can become controllers because of the role they play in determining purposes and essential means, even when they do not have a direct relationship with the individual and receive data through another company. Contractual labels or industry roles do not settle the analysis.
A joint controller arrangement should allocate responsibilities transparently, but it does not remove each party’s own accountability. Before participating in a data flow, an adtech provider should understand the source of the data, the consent interface shown to users, the purposes disclosed, the downstream recipients and the signals that demonstrate a valid choice. Where the evidence is incomplete, the controller should not assume that another participant has solved the compliance problem.
Publishers and advertisers also need visibility across the adtech supply chain.
The decision directly concerns Xandr, but the practical lesson extends to app operators, publishers, consent management providers, demand-side platforms, agencies and advertisers. Every organisation should identify its role and understand which data are made available during an auction, including data embedded in bid requests or capable of supporting sensitive inferences.
Publishers should not treat implementation of a consent management platform as proof that all downstream processing is lawful. They need to confirm that choices are accurately transmitted, withdrawals take effect and vendors use the data only for the purposes presented to the individual. Advertisers and agencies should also examine whether audience segments or inventory sources expose them to special category data or data obtained without a valid legal basis.
Real-time disclosure makes later remediation difficult.
Datatilsynet emphasised the opacity of the advertising ecosystem and the difficulty individuals face in knowing where their information goes. Once a bid request is distributed to numerous parties, a controller may be unable to recover the data, verify every subsequent use or provide an intelligible account of all recipients.
That structure increases the importance of data minimisation and prevention. Organisations should limit the information included in advertising requests, avoid transmitting unnecessary identifiers, block special category signals unless a valid Article 9 condition is demonstrable, and use technical controls to prevent unauthorised reuse. Retention, access and onward-sharing requirements should be enforceable rather than existing only in contractual terms.
The size of the fine reflects the seriousness and duration of the processing.
The infringements continued for almost two years, from July 2018 to April 2020. Datatilsynet treated the duration, the sensitive nature of the data and Xandr’s financial benefit from the processing as aggravating factors. The fine was calculated using Xandr’s own annual turnover because the company was not part of Microsoft during the relevant period.
The authority’s approach shows that longstanding industry practices do not reduce the need to establish a lawful basis. Where personal data processing is central to a business model, regulators are likely to expect a correspondingly mature evidence base for consent, controller roles and safeguards.
DPOs should test whether consent evidence survives beyond the first collection point.
For DPOs, the case provides a practical review question: can each controller demonstrate why it is entitled to receive and use the data, or does the organisation rely on an untested assurance from an upstream partner? Consent strings and contractual warranties should be checked against the actual user journey, the information presented and the processing performed by every relevant party.
A review should also consider whether apparently ordinary technical data reveal sensitive information because of their source or context. Records of processing, DPIAs and legitimate-interest or consent assessments must reflect the complete advertising architecture, including joint controllership, downstream recipients and the consequences of real-time disclosure.
Discover how Aphaia helps organisations govern digital advertising and consent.
Aphaia helps organisations map complex data flows, assess controller and processor roles, review consent mechanisms and build evidence of lawful, transparent processing. Practical DPIAs and supplier governance can help publishers, platforms and advertisers identify sensitive data risks before information enters a real-time advertising ecosystem.
