The complaint arrived at Norway's data protection authority on January 14, 2020. The decision is dated October 2, 2026, and was made public on October 12. In between lie nearly seven years, a fine of NOK 92m on Xandr, the ad exchange Microsoft bought in 2022, and a sentence that every intermediary in programmatic advertising will now have to read twice. "Our key message is that responsibility for data protection cannot be passed on to others," said Line Coll, Datatilsynet's director general.

PPC Land reported the fine on October 12. Datatilsynet found that Xandr, formerly AppNexus, received and passed on data from users of Grindr, the gay dating app, between July 2018 and April 2020, potentially to thousands of companies, without a valid legal basis. Being a Grindr user counts as information revealing sexual orientation, which is special category data under Article 9 of the GDPR and needs explicit consent. Xandr, the authority decided, was a joint controller with Grindr and did not check that such consent existed. The press release converts the fine to €8.6m; the decision itself uses Norges Bank's rate of September 15 and arrives at about €8.5m. The authority called it its highest fine to date. Grindr itself was fined NOK 65m in December 2021, cut from a proposed NOK 100m, and lost its final appeal on October 21, 2025. "This sends a powerful signal to everyone whose business model depends on tracking and profiling consumers," said Finn Myrstad of the Norwegian Consumer Council, which filed the complaint with noyb.

The 54-page decision says more than the press release. A second PPC Land account sets out the legal reasoning: Xandr acted as both a supply-side and a demand-side platform, the data covered at least the app name, advertising ID and IP address, and the infringements were found to be at least negligent, though not intentional. The fine was calculated on Xandr's own turnover rather than Microsoft's, because Xandr was not part of Microsoft during the infringement, which capped the penalty at €20m. The turnover figures themselves are redacted. And Xandr deleted records while it was under investigation, a deletion that the decision says "cannot be invoked in Xandr's favour." Its broader verdict on the business is unusually direct for a regulator: "The AdTech industry is particularly opaque and consists of a large number of companies exchanging personal data."

Then there is the clock. PPC Land's third piece on the decision counted the intervals in the case log. Three gaps with no recorded steps last about two and a half years, 14 months and 11 months, a total of more than four and a half years, or about 69% of the case. Time spent waiting for Xandr came to just over a year. Advance notice of the fine reached Xandr on April 3, 2025, more than five years into the case. Datatilsynet then treated its own slow handling as a mitigating factor under Article 83(2)(k) and reduced the fine, without saying by how much, and kept the reduction even after Norway's Privacy Appeals Board changed its practice on such discounts. The log covers only correspondence with Xandr, so the gaps do not prove inactivity, but the decision does not explain them. Xandr has three weeks to appeal. Microsoft shut its Invest DSP on February 28, 2026.

The case reaches the market at a moment when Europe's rules on time, files and consent are being rewritten. The same day, the European Commission published a draft implementing regulation for AI Act enforcement that would let the AI Office restart a five-year limitation period on fines each time it takes one of six investigative steps, from information requests to opening proceedings, up to an absolute ceiling of ten years. Companies under investigation would get no access to the file before preliminary findings, and unredacted access only through named external counsel and experts. The draft, dated October 12, names no company, though the providers of general-purpose AI models it covers include Google and Meta. Feedback closes on November 9, and adoption is planned for the fourth quarter. "Each interruption of the period referred to in paragraph 1 shall start time running afresh," the text says. Penalties under the AI Act reach €35m or 7% of turnover. PPC Land found drafting errors, including a reference to a paragraph 6 that does not exist.

In the European Parliament, the argument is over the substance of the rules rather than the timetable. noyb, the Vienna group chaired by Max Schrems, launched a site that grades more than 1,000 amendments to the GDPR and ePrivacy sections of the Digital Omnibus. PPC Land's analysis of the scores found that the European People's Party tabled 248 amendments noyb judged to weaken privacy, against 24 that strengthened it, for a net score of minus 224. The 17 lowest individual scores all belong to EPP members, led by Axel Voss at minus 67. Greens/EFA scored plus 17. "Almost every parliamentarian claims to 'uphold' people's rights, but many do the exact opposite," Schrems said. noyb has not published its grading criteria, the amendments are not weighted by importance, and the source is an advocacy group. Parliament is still at committee stage.

So the Norwegian decision lands with three propositions attached. A regulator can take nearly seven years. An intermediary cannot rely on someone else's consent. And the rules under which the next such case would be tried are themselves in motion. Responsibility that "cannot be passed on to others" was the theme that recurred, in less formal language, across much of the rest of the day.

Google tightens the gates it runs

Google spent the day closing some doors and opening others, and the doors it closed affect the people who measure it. Barry Schwartz reported for Search Engine Roundtable on October 12 that third-party rank tracking is struggling after weeks of stronger blocking. Derek Perkins of Nozzle described three methods: wide IP blocking aimed at residential proxy networks, more captchas, and the injection of bad data into results served to suspected scrapers. Nozzle found 8.0% of results pages poisoned since September. "The third approach, injecting bad data, concerns me the most," Schwartz wrote. Google made no statement.

DemandSphere put a larger figure on it. Its founder, Ray Grieselhuber, linked five company posts on October 12 that describe wrong results on about 11% of its daily rank checks, more aggressive blocking from around September 11 and the cost of Google's "goto" redirect links, which Nozzle says require 500 to 1,000 requests per five-page ranking. "Right around September 11th, Google deployed the most aggressive blocking that we have seen to date," Grieselhuber said. His reading is that "Google does not want the AI labs to use their SERPs as part of their live retrieval process to answer questions." Google's only statement on the subject is general: "We have a long history of deploying technical measures against evolving forms of abuse." The two companies use different keyword sets and undisclosed methods, and a hearing on SerpApi's motion to dismiss Google's amended complaint is scheduled for October 13. Both figures are self-reported by firms that sell the data now under pressure.

Bots of another kind disappeared for reasons nobody in search had planned for. YandexBot traffic on Cloudflare Radar fell 94% on October 11 against the second-half-of-September average, after drone strikes on Yandex data centres at Sasovo and Kaluga and then Vladimir. Earlier drops of about 25% and 35% preceded it, and traffic had partly recovered to 10% to 20% of the window maximum by October 12. Yandex Cloud traffic fell 82%. Radar shows normalised values from Cloudflare-fronted sites only, and PPC Land noted that claims about a fall in social media bots have no platform data behind them.

On its own platforms, Google is loosening rules where the friction falls on advertisers. Merchant Center's help page on low image quality no longer says flagged products may be blocked from ads and free listings; it now notes that products "will continue to show." Schwartz covered the same change for Search Engine Roundtable, crediting Hana Kobzová of PPC News Feed, and suggested the products may still suffer in click-through rates. The 500 by 500 pixel minimum still takes effect on January 31, 2027. Google gave no date for the change and no reason.

The editorial policy is moving in the same direction. From October, Google Ads will let business names differ from the destination domain if three conditions are met: the name reflects the advertiser's recognised brand, there is "a verified direct relationship" between advertiser and domain owner, and the products or services are directly offered on the domain. Resellers, independent booking intermediaries, affiliate distributors and secondary sellers are excluded. How the relationship is verified, and how "recognised" is judged, is not explained. The 25-character limit is unchanged.

Campaign setup is being steered toward Google's own suggestions. Ginny Marvin, Google's Ads Liaison, confirmed to Search Engine Roundtable that a screen asking advertisers for a campaign goal and promising that "Google AI will suggest goals and assets" is an experiment. PPC News Feed reported on October 12 that the free-text box has become the main starting point in the campaign creation interface, with manual setup reduced to a smaller link; when AI-guided creation was first spotted in March, manual setup sat directly below it. PPC News Feed also noted a grey box design being tested in Shopping ads, replacing the white background, with the grey version dropping the "Shop now" button.

Developers face a faster rhythm. The Google Ads API moves to two releases a month from v26, Anash P. Oommen announced on October 12. There will be 21 releases in 2027, four of them major versions with breaking changes and 17 minor ones that only add features. Google says major versions last "one year," but its own table implies about 13 months. Google framed the change as giving "automated agents and workflows near-instant access to cutting-edge features," and reserved the right to "add or remove releases, or switch a release between major and minor."

Google's AI answers are acquiring advertisers in some of the most regulated categories. Trishla Ostwal reported for Adweek on October 12 that Google is testing ads for branded prescription drugs in AI Mode and AI Overviews, limited to the US. "We're testing standard text and Shopping ads in AI Mode and AI Overviews," a Google spokesperson said. Gambling is moving onto YouTube's most prominent placement. PPC News Feed reported that YouTube Masthead ads will accept certified online gambling advertisers from October 21, excluding operators not subject to mandatory state or national registration. Prediction markets are going the other way, state by state: Google now bars prediction market ads in Connecticut, effective October 7, after earlier bans in Ohio, Michigan and New York.

When Google's AI has nothing to say, it still says something. Schwartz documented AI Overviews appearing for typos and queries with no matching pages, sometimes responding that the input looks like a typo or random keyboard input. Schwartz observed that AI rarely admits it does not know. Microsoft, meanwhile, is testing a new model in its own search products. Microsoft staff said Microsoft-Decision-1, a decision-scoring model for routing, classification and verification released the previous week, is being tested in Bing and Copilot. "We're experimenting with it in Copilot and it's pretty good!" said Rangan Majumder.

The next surface Google wants to reshape is Discover. A Google job listing for a Principal UX, Search Discover, at Director level, offers base pay of $275,000 to $382,000 plus a 30% bonus target and equity, and asks for 15 years of experience managing UX organisations. The role is to "transform Discover into a proactive, hyper-personalized concierge experience," including "creator/publisher value exchanges" and a strategy for "youth demographics." Damien Andell of 1492.vision flagged it on October 11. A job listing is not a roadmap, but publishers have reason to read it: NewzDash data puts Discover at 67.51% of Google traffic to news sites in the fourth quarter of 2025, up from 37.03% in 2023.

Paying for what used to be free

Google's local advertising is also changing hands. LSArespond, a New York company that automates Local Services Ads lead handling, claims more than 2,000 active users in the US, UK and Canada, and more than 115,000 leads processed in August, as Google moves Local Services Ads into Performance Max. Missed calls during business hours have been billable since October 1 when the caller stays on the line for more than 20 seconds. Founder Uri Turk called the milestone proof of "the category leader in LSA automation," a claim that rests on the company's own figures; revenue, funding and customer names were not disclosed.

Amazon is turning a free courtesy into an ad product. From late October, it will sell Review Requests ads to US sellers and vendors that ask recent verified buyers to leave a rating, for products with fewer than 1,000 ratings and reviews; the ads pause automatically at 1,000. A 19-day closed beta in June claimed "three times as many ratings and reviews per week," measured against each product's own earlier rate with no control group. Pricing and cost per review were not disclosed. "Same authentic reviews customers already leave. Just more, and faster," Amazon Ads said. Ravi Jaipaul argued that the number that matters is "fully loaded cost per incremental review." Amazon's second-quarter advertising revenue rose 26% to $19.8bn.

The buyers, the brokers and the scorecards

Out-of-home has its first global programmatic tally, with caveats. The WOO Global pDOOH Expenditure Study puts 2025 programmatic digital out-of-home spend at $1.339bn, 7.0% of digital out-of-home, from confidential net revenue submitted by 12 SSPs to PwC. The US accounted for $545.5m; Germany, at $216.3m, had the highest penetration at 31.8%. Private marketplaces took 75.7% of spend and open auction 17.4%. "75.7% PMP share is not a channel maturing through its open-auction phase - it is the baseline," said Charles Parry-Okeden of WOO. PwC "did not audit, verify, review or assure" the data, and the study's two reports give conflicting retail figures of $165m and $190m.

Creative is being scored before money is spent. Bannerflow launched Creative Intelligence, adding attention heatmaps, focus analysis and clarity scoring to its creative suite across display, social, video, connected TV and digital out-of-home. "Marketing teams have more performance data than ever, but too little of it inspires the next piece of creative," said Moses Velasco, chief product officer. Pricing, release dates and the attention model's training data were not disclosed.

Zeta Global keeps buying. It agreed to acquire Senso, a Toronto AI engineering company from Y Combinator's Winter 2024 batch whose technology already powers Zeta's generative engine optimisation product, which tracks brands across ChatGPT, Gemini, Claude and Google AI Overviews. David A. Steinberg, Zeta's chief executive, said Senso would bring "deeper connectivity to the frontier models." No price was disclosed. Ronan Shields' Ad Tech Briefing for Digiday on October 13 placed the deal within a busy Advertising Week for Zeta, which also unveiled AthenaOS and Athena MCP at its Zeta Live event on October 8, with a public beta later in 2026 and general availability in the first quarter of 2027. The same briefing described executives discussing Apple's iOS 27 targeting changes, often off the record, with talk centred on who is on Apple's blocklist, and quoted Brian O'Kelley of Apostra: "Amazon is acknowledging that a programmatic-only DSP makes little sense outside a web-centric universe." Market capitalisations it cited from Yahoo Finance put AppLovin at $93bn, Zeta at $8.3bn and The Trade Desk at $5.7bn.

The market for AI visibility is crowded enough to need a list. Kendra Barnett profiled 11 of the best-funded GEO startups for Adweek on October 12, citing Similarweb data that roughly one in ten online searches worldwide now runs through a standalone AI tool, and noting Profound's $1.8bn valuation. "A burgeoning cottage industry of tech startups promises to have the solution," she wrote.

Acquisitions raise the question that Norway's regulator answered for consent. In an AdExchanger opinion column on October 12, Stewart Sullivan, chief executive of Drako, argued that after Infillion's acquisition of Foursquare, data providers have to prove their neutrality rather than promise it, through transparent information boundaries and equal treatment of customers across platforms. "Independence has value because it preserves choice," he wrote. The column does not say how Drako relates to either company.

Measurement can be fixed at the scale of a single brand. Allison Schiff told the story of PureOne Golf for AdExchanger on October 12. Shane Jackson, a former golf pro who bought the Scottsdale company in November 2024, found website conversions stuck at 0.2% to 0.3% under an agency that blamed shoppers for buying on Amazon instead. "Nothing ever seemed to add up," Jackson said. Digital Position, the growth agency that replaced it, unified reporting across Shopify, Amazon, Google and Meta, added server-side tracking because platforms "only see around 60% to 70% of the purchases," and separated new customers from existing ones. "Attribution looks wonky because everyone wants credit," said Steve Cozzolongo, its partner and chief marketing officer. Jackson reports website conversions up 463% compared with 2025, a self-reported figure.

Small agencies are rethinking how many people the work needs. Michael Bürgi interviewed the founders of BaD Mktg for Digiday on October 13. Ian Buck and Yotem Dor, who left a large agency group to start the two-person shop in 2023, say it has generated more than $2m in revenue in three years, using several language models and an in-house tool called Goody for back-office work. Concepting has dropped from six weeks to six days or less, and a brief now produces 100 headline variations. "Most of them are shit, worse than humans. But there's 100 of them to choose from," Buck said. The revenue figure is cumulative and unsourced.

Marketing departments rearranged

On the client side, the day's changes were about who sits where. A memo obtained by Adweek shows Spectrum is removing its chief marketing officer, Sharon Peters, and its chief commercial officer, Adam Ray, at the end of the year and eliminating the commercial officer role. Nick Jeffrey, chief operating officer, wrote that the company had "underperformed the markets, and our own expectations" and that "we have failed to marshal those advantages into a winning strategy."

United Airlines has reorganised Kinective Media, its two-year-old advertising network, merging its media sales and operations team with the MileagePlus loyalty partnerships team to focus on seat-back screens and Starlink connectivity, Mitchell Parton reported. "This puts our partner strategy and media capabilities together," wrote Andrew Nocella, chief commercial officer. Authentic Brands Group, preparing for a public offering in the first half of 2027, hired Lark-Marie Antón from USA Today Co. as its first chief communications officer, Mark Stenberg reported.

Campaigns, culture and the newsroom

The creative work of the day leaned on recognisable faces. Sprite launched "Never Stop Refreshing the Game" with Nikola Jokić ahead of the NBA season, which begins on October 20, casting the three-time MVP as a comedian whose jokes barely land in a dark club. Novig released a sequel to its "Just Sports" campaign with Sydney Sweeney, shared on Instagram on October 11, after the first spot reportedly helped quadruple the company's valuation; Powerade has offered a counterpoint, Rebecca Stewart reported. At CultureCon, held on October 3 and 4 at the Duggal Greenhouse in Brooklyn, Chase Ink, Cricket Wireless, Lincoln, HBO Max, Audible and Pinterest built activations around practical resources and storytelling, Bianca Brutus wrote.

The newsroom stories carried the day's theme of responsibility into politics. The Department of Justice has opened an antitrust investigation into ABC News, CBS News, NBC News, CNN and Fox News, examining whether their temporary suspension of pool coverage of President Donald Trump amounted to a collective boycott under the Sherman Act; the networks learned of it on October 9. ABC News attached an editor's note to a story about Pentagon contracts and 1789 Capital, the investment firm partly backed by the president's sons, saying the October 7 version contained errors about investments, contracts and the order of events. The firm had asked for corrections, including that the investment was in the millions, not billions.

The search industry also lost one of its own. Nick Wilsdon, founder and chief executive of Torque and an SEO practitioner for more than two decades, with earlier roles at eBay and Vodafone, died on October 11 after battling cancer. "He was always happy, smiling and more importantly, wanted to make others around him happy and smarter," Schwartz wrote.

What the day added up to

Datatilsynet's decision contains the line that best explains the day: "The NO DPA holds that accountability cannot be outsourced." Xandr could not lean on Grindr's consent. Rank trackers cannot assume the results Google serves them are real. An advertiser can no longer show a business name that differs from its domain without a verified relationship to that domain. Amazon's sellers will pay to be asked for reviews. Buyers of acquired data providers are being told to demand proof of neutrality, and a golf brand found that its agency's attribution story did not add up.

The regulators did not exempt themselves. Norway took nearly seven years and then reduced its own fine for the delay. The Commission's draft would let the AI Office restart its clock six different ways. Parliament's privacy amendments arrive with a scorecard from an advocacy group that has not published its criteria. If accountability cannot be outsourced, it cannot be deferred indefinitely either, and the market will judge the regulators by the same standard they now apply to the intermediaries.

By the numbers

NOK 92m
Datatilsynet's fine on Xandr, which the authority described as its highest to date.
Norway fines Microsoft's Xandr NOK 92m over Grindr users' sensitive data

Nearly 7 years
Time between the Consumer Council's complaint and the decision, with over four and a half years showing no logged steps.
Norway spent nearly seven years on Xandr, then cut the fine for the delay

248
Amendments from the EPP group that noyb graded as weakening privacy in the Digital Omnibus.
EPP tabled 248 omnibus amendments weakening privacy, noyb finds

$1.339bn
Programmatic digital out-of-home spend worldwide in 2025, only 7% of the digital out-of-home total.
Programmatic DOOH hit $1.339bn in 2025, just 7% of digital OOH, WOO finds

November 9
Deadline for feedback on the Commission's draft rules for AI Act investigations and fines.
EU draft lets AI Office restart 5-year fining clock on Google and Meta AI