Norway Fines Adtech Company NOK 92 Million

What's New?

On October 12, the Norwegian Data Protection Authority announced a fine of NOK 92 million (approximately €8.6 million) against Xandr, an advertising technology company now owned by Microsoft.

Xandr shared sensitive personal data from Grindr users through real-time bidding (RTB) without a valid legal basis.

The authority found that Xandr was a joint controller and could not simply assume that Grindr had obtained valid consent. The decision remains open to appeal.

Why It Matters

Privacy responsibility extends beyond the company collecting the data. Every participant in the advertising ecosystem must establish and document the lawfulness of its own processing.

Recommended Action

Review data shared with advertising platforms, verify consent mechanisms and signals, and assess safeguards for sensitive personal data.