Norway

Xandr Inc.

8,500,000 €

GDPR enforcement action by Norwegian Supervisory Authority (Datatilsynet) on 2026-10-02.

Rank · Sector

#10

of 645 in Industry and Commerce

Rank · Norway

of 55

Rank · All fines

#55

of 3,223

Case details

Authority: Norwegian Supervisory Authority (Datatilsynet)
Date: 2026-10-02
Controller / Processor: Xandr Inc.
Sector: Industry and Commerce
Quoted Articles: Art. 6 (1) GDPR, Art. 9 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Norwegian DPA has imposed a fine of EUR 8,500,000 on Xandr Inc. The controller provides real-time ad data bidding services. Through this, it received personal and sensitive personal data from Grindr users in Norway. This data was passed on to more than 4,000 third-party providers. Although Xandr was a joint controller with Grindr, it did not have a legal basis for data processing as it relied on the consent given through Grindr's consent management system, which was found to be invalid (ETid 950). The data processed by Grindr also contained information about users' sexual orientation.

Open original source Links to the regulator's original publication or another source.