Norwegian DPA Levies Record €8.6M Fine on Xandr for Grindr Sexual Orientation Data in RTB Flows

The Norwegian DPA determined Xandr bore joint-controller duties under GDPR Article 26 yet relied on Grindr's upstream consent claims while participating on both buy and sell sides of real-time bidding. User profile data, including inferred sexual orientation, was broadcast to potentially thousands of downstream actors each time the app opened, creating uncontrolled secondary processing the authority labeled systemic.

Contract records show Xandr's platform agreements contained standard data-processor language that shifted liability downstream, a pattern repeated across multiple adtech vendors. The fine calculation used Xandr's pre-acquisition turnover, avoiding any Microsoft balance-sheet impact and highlighting how corporate restructuring can limit regulatory leverage.

Independent complaints from Forbrukerrådet and noyb documented the same RTB consent failures previously flagged in the 2020 IAB Europe investigation, yet enforcement lagged until Norwegian authorities examined actual data-flow logs rather than self-attestations. This case reveals the gap between declared consent mechanisms and observable packet-level dissemination.

Microsoft's review period and Xandr's three-week appeal window will test whether adtech intermediaries adopt verifiable consent tokens or simply restructure contracts again. Parallel proceedings against other RTB platforms are expected to reference this decision directly.