# Datatilsynet (Norway) - 20/03541-37

- Type: Enforcement
- Source: Datatilsynet (NO)
- Date: 2026-10-13
- Original: https://gdprhub.eu/index.php?title=Datatilsynet_(Norway)_-_20/03541-37
- Canonical: https://overview.legal/posts/597796
- Topics: Controllers, Personal Data, Consent, Joint Controllers, Data Controller, Consent Validity Requirements and Conditions, Supervisory Authorities

## Summary

The DPA fined Xandr NOK 92,000,000 (€ 8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. English Summary. Facts. The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bid

## Full text

The DPA fined Xandr NOK 92,000,000 (€ 8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. English Summary. Facts. The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where th

---
Generated by overview.legal · https://overview.legal/posts/597796 · 2026-10-13