News · European Data Protection Board EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data

Personal Data Special Categories of Data Processing IP Address Lawfulness
Oct 16, 2026 Source edpb.europa.eu

Full text

Background informationDate of final decision: 2 October 2026National case Controller: Xandr Inc.Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)Decision: Administrative fineKey words: Fines, Basic principles, Marketing, Online platformsSummary of the DecisionOrigin of the case The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people.Key Findings The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR an

How it connects

Related across sources

C-579/21 Proceedings brought by J.M In Case C-579/21, the Court of Justice of the European Union ruled on a preliminary reference from the Itä-Suomen hallinto-oikeus (Administrative Court of Eastern Finland)… First Chamber Jun 22, 2023 Personal Data Right of Access IP Address
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) Jan 12, 2023 Supervision IP Address Integrity and Confidentiality Principle
C-340/21 VB v Natsionalna agentsia za prihodite C-340/21 (VB v Natsionalna agentsia) Dec 14, 2023 Data Breaches Integrity and Confidentiality Principle Notification Obligation
C-200/23 Agentsia po vpisvaniyata v OL The Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Bulgarian Supreme Administrative Court in a dispute between the Agentsia po… First Chamber Oct 4, 2024 Personal Data Right to be Forgotten Liability
C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) Apr 8, 2014 Storage Limitation Child Consent IP Address
C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV C-40/17 (Fashion ID) Jul 29, 2019 Controllers Legitimate Interest Integrity and Confidentiality Principle
Related documents