Programmatic · Status at source date: Regulatory decision
Norwegian regulator fines Xandr for Grindr real-time bidding data
Norway’s data protection authority announced a NOK 92 million fine against Xandr on 12 October, concerning Grindr data used in real-time bidding.
What changed
The decision is dated 2 October and addresses conduct from 2018 to April 2020, before Microsoft acquired Xandr. The authority treats Xandr as a joint controller with responsibility for checking lawful processing. Its notice allows three weeks from receipt of the decision to appeal; this draft does not establish the appeal outcome. The case highlights the need to examine consent assumptions across the advertising data supply chain.
The timing is central to an accurate reading of the case. A decision about earlier conduct is not a finding about every current Microsoft advertising product or every present-day real-time bidding transaction. The notice identifies a particular company, dataset and processing period. Its reasoning should be examined within that scope rather than converted into a blanket statement about the whole market.
For advertisers and data teams, the useful question is how responsibilities are checked when information passes through several organisations. A partner’s assertion that consent exists is not the same thing as evidence that a particular use is permitted. As a practical governance exercise, map the data involved, the parties receiving it and the purpose for which it is processed. Ask the responsible privacy team to compare those arrangements with the contracts and consent records relied on. This article does not provide a legal assessment of another organisation’s compliance.
Keep the regulator’s decision date, its public announcement and any later appeal development separate in reporting. The stated appeal period does not establish whether an appeal was filed or what its outcome might be. Do not describe the matter as finally resolved without further evidence. The complainant organisations remain part of the source history, while the primary regulator notice supports the reported fine.
Why it matters for advertisers
The case highlights the importance of checking responsibility and evidence across advertising data-sharing chains.
What to check next
- Read the regulator notice within its stated company and time scope.
- Review data-sharing responsibilities with the privacy owner.
- Track appeal developments separately from the announced decision.
Sources & contributor credit
- Official Source · Datatilsynet
Norwegian regulator notice read; decision 2 October, public notice 12 October, conduct 2018 to April 2020. Not a finding about present-day campaigns. Appeal outcome unresolved.
- Regulator summary · European Data Protection Board
- Complainant and visual source · Forbrukerrådet
- Original complainant release retained from private draft · noyb
Earlier discovery source retained; regulator notice and EDPB statement now support the decision details. Appeal outcome remains unresolved.
Source attribution checked
Datatilsynet is the official decision source. The EDPB, Forbrukerrådet and noyb retain their separate reporting, complaint and discovery roles.
Attribution evidence and limitations
The published text and credit roles were independently reviewed for this exact version. Datatilsynet is the official decision source. The EDPB, Forbrukerrådet and noyb retain their separate reporting, complaint and discovery roles.
Original sources and secondary discovery links are distinguished in the article. Unresolved first-reporting priority is not treated as confirmed authorship.
Selected media and displayed credits were inspected. Forbrukerrådet. Source access and credit do not establish ownership or permission to reuse.
Attribution checked . This is a review date, not the original publication date.
- Published on this site
- Article updated
This update reflects the dated source reporting. Availability may have changed. Further coverage of this same development will be added to this page.
