Xandr did not collect consent itself. It relied on Grindr's. The Norwegian regulator says that consent was invalid, and borrowed consent does not carry over.
Fact
The facts: Norway's data protection authority, Datatilsynet, announced a fine of NOK 92 million, which is EUR 8 600 000 in the EDPB's summary, on Xandr Inc., an advertising company formerly called AppNexus and now part of Microsoft. The final decision is dated 2 October 2026. The case began in 2020, when the Norwegian Consumer Council lodged a complaint. It concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people. The authority found it proven that Xandr processed at least the fact that individuals were using Grindr, their advertising IDs and their IP addresses. These are personal data and data concerning sexual orientation under Article 9(1) GDPR. Xandr is a joint controller, both as a supply-side and a demand-side platform. The fine is for processing the data of Grindr users in Norway without a legal basis under Article 6(1), and for processing special category data without a valid exemption under Article 9(1). The authority regards the infringements as at least negligent and of high seriousness.
The data is simple: that a person uses Grindr, their advertising ID and their IP address. But being in an app like that is itself information about sexual orientation, and that is a special category. For it, the law requires explicit consent.
Accountability does not transfer.
The key line is in the summary of the decision: “accountability cannot be outsourced”. Each joint controller must independently verify that consent is valid and covers its own processing. That is how the Norwegian authority reads it, for data of users in Norway.
Grindr itself has a separate fine from the same authority, NOK 65 million. The Borgarting Court of Appeal upheld it on 21 October 2025. How Microsoft and Xandr react, and whether they will appeal, the sources do not say.
If you sit in the middle of the advertising chain and receive someone else's data, you must be able to show the consent itself. A contract clause is not enough.
Sources
EDPB - Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data, 16.10.2026Datatilsynet - News: Microsoft company fined NOK 92 million, 12.10.2026The visual is generated code-art, no third-party images.