- Date
- October 12, 2026
- Kind
- Regulatory change
- Significance
- High
Datatilsynet, Norway’s data protection authority, fined Xandr (formerly AppNexus, bought by Microsoft in 2022) NOK 92 million in a decision dated October 2, 2026, made public on October 12. It found Xandr received and passed on Grindr users’ data from July 2018 to April 2020 without a valid legal basis; because Grindr use reveals sexual orientation, the data is special category data under GDPR Article 9, which requires explicit consent.
Details
- The authority found Xandr was a joint controller and did not verify that consent existed; the data included at least the app name, advertising ID and IP address.
- It is the authority’s highest fine to date (€8.6 million in the press release, about €8.5 million in the decision), based on Xandr’s own turnover and reduced for the authority’s slow handling.
- The complaint was filed on January 14, 2020 by the Norwegian Consumer Council with noyb; Grindr was fined NOK 65 million in December 2021.
Why it matters
This is our analysis. Platforms in a bidding chain can be held responsible for consent they did not check, especially for sensitive categories.
What happened next
Xandr has three weeks to appeal; it was not stated whether it has.