The Norwegian Data Protection Authority has fined the advertising technology company Xandr Inc. EUR 8,600,000 for unlawfully processing personal data of Grindr users during real-time bidding, according to a summary published by the European Data Protection Board. Xandr was known as AppNexus when the case began and is now part of Microsoft.

The decision rests on two provisions of the GDPR: Article 6 on lawfulness of processing and Article 9 on special categories of personal data. The EDPB lists the date of the final decision as 2 October 2026 and classifies it as a national case resulting in an administrative fine. The full summary is available on the EDPB website.

The case has a long tail. It started in 2020, when the Norwegian Consumer Council lodged a complaint against Xandr with the Norwegian DPA. The complaint concerned real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people. Real-time bidding is the auction process in which ad slots are sold to the highest bidder in the milliseconds between a user opening an app and the ad loading. Each auction carries data about the user so that bidders can decide what the impression is worth.

The DPA found it proven, by what it calls a clear preponderance of probability, that Xandr processed Grindr users' personal data during that bidding. At minimum, that data covered the fact that an individual was using Grindr, the user's advertising ID and the user's IP address. The regulator treated these as personal data under Article 4(1) GDPR and, because of what Grindr is, as data concerning sexual orientation under Article 9(1).

That second finding is what drove the outcome. Once data falls into a special category, the ordinary legal bases in Article 6 are not enough on their own. The DPA concluded that explicit consent under Article 9(2)(a) was the relevant legal basis here. Xandr did not collect that consent itself. It relied on consent obtained by Grindr, and the DPA held that Grindr's consent was invalid under Articles 4(11) and 7 GDPR, which set out the definition of consent and the conditions under which it is valid.

The DPA also rejected the idea that Xandr was a mere pipe. It found the company to be a joint controller for the processing in both of the roles it played in the auction, as a supply-side platform and as a demand-side platform. The published summary states the DPA's position plainly: accountability cannot be outsourced. The EDPB text available at the time of writing is cut short at that point, so the full reasoning behind that line, and any detail on how the fine was calculated, is not yet visible in the summary.

The summary also does not say whether Xandr or Microsoft intends to challenge the decision, and it includes no statement from either company. Readers should treat the fine as the headline fact and wait for the full decision before drawing conclusions about remediation orders or timelines.

For identity practitioners, this is less a story about advertising and more a story about delegated trust. Xandr accepted a consent signal from an upstream party and built processing on top of it. The regulator said that signal was worthless and that the downstream party owns the problem anyway. Anyone who runs a federation, a CIAM platform or a partner integration will recognize the shape of that argument. Trusting an assertion you did not verify is a time-honored engineering tradition, and the fine shows the going rate for it in Norway is now EUR 8.6 million. The encouraging part is that the fix is boring and well understood: know what data you receive, know why you are allowed to have it, and be able to prove both.

Identity and security teams should check three things. First, inventory every third-party consent or legal-basis signal your systems rely on (consent strings, partner flags, SSO claims about user agreement) and confirm you can show how that consent was obtained and that it meets Articles 4(11) and 7, rather than assuming the sender did the work. Second, review whether any attribute you process reveals special category data by implication, such as the mere fact of membership in a service aimed at a protected group, and whether your legal basis for that attribute is explicit consent rather than legitimate interest. Third, revisit controller and processor roles in your data processing agreements for anything that looks like a two-sided platform, because the DPA treated both sides of the auction as a joint controller, and your contracts may not.