Enforcement · Datatilsynet (NO) ·20/03541-37 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Datatilsynet (NO) · 20/03541-37

The DPA fined Xandr NOK 92,000,000 (€ 8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding.

Status Not cited by any decision here yet

€8,500,000 Fine
Norway
Controllers Personal Data Consent Joint Controllers Data Controller
GDPRhub page Oct 13, 2026 Source gdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

The DPA fined Xandr NOK 92,000,000 (€ 8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. English Summary. Facts. The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where th

How it connects

Related across sources

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Controllers Personal Data
C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… CJEU ·Fourth Chamber Mar 7, 2024 Controllers IP Address Personal Data
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Personal Data Controllers Integrity and Confidentiality Principle
3 O 762/19 LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit… Sep 15, 2020 Consent Legitimate Interest Controllers
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors Joint Controllers
M 32 E 26.3990 VG Munich: university may be GDPR controller for professors' editorial work emails The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a… Administrative Court Munich Aug 11, 2026 Controllers Right of Access Legitimate Interest
Related documents