# Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data

- Type: News
- Source: European Data Protection Board
- Date: 2026-10-16
- Original: https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en
- Canonical: https://overview.legal/posts/599505
- Topics: Personal Data, Special Categories of Data, Processing, IP Address, Lawfulness, Controllers, Supervisory Authorities, Integrity and Confidentiality Principle, Article 14 Information Provision Requirements

## Summary

Background informationDate of final decision: 2 October 2026National case Controller: Xandr Inc.Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)Decision: Administrative fineKey words: Fines, Basic principles, Marketing, Online platformsSummary of the DecisionOrigin of the case The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, n

## Full text

Background informationDate of final decision: 2 October 2026National case Controller: Xandr Inc.Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)Decision: Administrative fineKey words: Fines, Basic principles, Marketing, Online platformsSummary of the DecisionOrigin of the case The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people.Key Findings The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR an

---
Generated by overview.legal · https://overview.legal/posts/599505 · 2026-10-17