Norway's data protection authority, Datatilsynet, today made public a NOK 92 million fine on Xandr, the advertising technology company now owned by Microsoft, for passing on the data of Grindr users without a legal basis. The complaint behind it reached the authority on January 14, 2020. The decision is dated October 2, 2026, which is 2,453 days later. When it set the amount, the authority lowered the fine because the case had taken so long. The chronology in its own 54-page decision shows three stretches, of 935, 422 and 345 days, in which no step in the investigation is recorded. Together they make up 1,702 days, about 69% of the life of the case. The decision does not explain any of them.

In Short

A Norwegian consumer group complained in January 2020 that an ad company called Xandr was passing on information about people using the dating app Grindr, and Norway's privacy regulator only issued its decision in October 2026. The regulator's own record shows that for most of those nearly seven years, nothing visible happened in the case, and in the meantime Xandr deleted records, changed owners and closed part of its business. The regulator then reduced the fine to make up for its own slowness, even though the appeals board that reviews its decisions had already stopped giving that kind of discount. Norway is not alone: PPC Land's coverage shows privacy cases across Europe routinely taking five to eight years, because regulators are short of staff, the procedures invite appeals, cross-border rules add extra layers, and some authorities simply do not act. The upshot is that a fine arriving years after the conduct says little about what a company does today, and the people affected may never learn exactly what happened to their data.

2,453 days, step by step

PPC Land reported the fine and then examined the 54-page decision earlier today. The decision contains a dated list of the exchanges between Datatilsynet and Xandr. Read with the intervals worked out (PPC Land's arithmetic, not figures stated in the decision), it looks like this:

  • January 14, 2020 - The Norwegian Consumer Council's complaint against Xandr, then AppNexus, reaches the authority.
  • February 21, 2020 - First order to Xandr to provide information, 38 days later.
  • March 16 to July 17, 2020 - At Xandr's request, the authority extends the reply deadline by 123 days.
  • July 16, 2020 - Xandr responds.
  • July 16, 2020 to February 6, 2023 - No step recorded: 935 days.
  • February 6, 2023 - Second order to provide information. Because of a staff change at Xandr, it reaches the right person only on March 28, 2023, 50 days later.
  • May 26, 2023 - Xandr responds after two further extensions.
  • August 23 to October 2, 2023 - Exchanges over the data agreement between Grindr and Xandr and Xandr's relationship with MoPub.
  • October 2, 2023 to November 27, 2024 - No step recorded: 422 days.
  • November 27 to December 20, 2024 - A third order and Xandr's replies.
  • February 27, 2025 - An informal online meeting.
  • March 18 and 25, 2025 - Turnover figures ordered and supplied.
  • April 3, 2025 - Advance notification of the intended fine, 1,906 days after the complaint.
  • June 2, 2025 - Xandr's response to the advance notification.
  • June 20 and 23, 2025 - Xandr sends suggested redactions to the advance notification, and the authority confirms receipt.
  • June 23, 2025 to June 3, 2026 - No step recorded: 345 days.
  • June 3 and 15, 2026 - Updated turnover figures ordered and supplied.
  • October 2, 2026 - The decision is dated.
  • October 12, 2026 - The fine is made public.

One caveat matters. The chronology lists correspondence with Xandr. It does not record internal work, staffing or anything else the authority was doing on the file, so "no step recorded" means exactly that: nothing appears in the record the authority chose to publish. Datatilsynet has not said what happened in those periods.

Where the clock ran

The record allows a rough division of time between the company and the regulator.

Periods in which the authority was waiting for an answer from Xandr, counted from each order to the corresponding reply, add up to 397 days, about 16% of the case. They include the 123-day extension Datatilsynet granted in 2020, the 50 days in 2023 that a letter spent inside Xandr before reaching the right recipient, and the 60 days Xandr took to answer the advance notification. Much of that time traces to extensions Xandr requested, most of which the authority granted, or to delays inside the company.

The three stretches with no recorded step add up to 1,702 days, about 69%. No order was outstanding during any of them, and no reply was being waited for. On the record, the next move in each case belonged to Datatilsynet.

The authority finished the case in much the same way. The advance notification went out on April 3, 2025. Xandr answered on June 2, 2025. The decision followed 487 days later. Apart from an exchange over redactions to the advance notification later that June, the only recorded event in that time is a request for fresh turnover figures a year after Xandr's reply.

A discount for the regulator's own delay

The decision says plainly that the delay worked in Xandr's favour. "The practice of the Norwegian Privacy Appeals Board indicates that lengthy case handling time is an element to be considered under Article 83(2)(k) GDPR. Therefore, the NO DPA regards this a mitigating factor," it states. In the section on the amount: "In accordance with the practice prevailing at the time of the advance notification, the length of the case handling time was regarded a mitigating factor. Accordingly, the amount of the fine has been reduced in this case."

The decision does not say by how much. It does not give the starting amount either. The reduction was built into the calculation before NOK 92 million was made public, so that figure is the result after the discount, not a number that was later lowered.

A footnote adds a further twist. The Privacy Appeals Board, whose practice the authority relied on, changed that practice after the advance notification was sent, in its decision PVN 2025-30. Datatilsynet kept the discount anyway: "Although The Privacy Appeals Board has revised their practise regarding reduction for long case handling time after NO DPA sent the advance notification, NO DPA have decided to uphold what already was notified in this regard."

Xandr wanted more. It argued that "elimination of" the fine, "or at a minimum a further decrease in the amount", was "particularly warranted in this case given the impact that the NO DPA's delays have had on Xandr's ability to defend itself." The authority rejected the claim that its delays had undermined Xandr's defence. It did not dispute that they were its delays.

One sentence in the decision sits awkwardly against all this. Explaining why a fine was needed, the authority wrote that "enforcement efforts must generate sufficient pressure to make non-compliance economically unattractive in practice." In the same decision it lowered the fine because its own enforcement had been slow.

The evidence that disappeared in the gap

The longest gap carries the decision's most serious finding against Xandr. The company told the authority that documentation about its Grindr processing had been deleted under its retention policies "during the period from 16 July 2020 to 6 February 2023."

Those dates are not arbitrary. July 16, 2020 is the day Xandr answered the authority's first order. February 6, 2023 is the day the second order was sent. The deletion window and the authority's 935-day silence are the same period.

Datatilsynet held the deletion against Xandr. "This deletion occurred notwithstanding that Xandr had been aware of the NO DPA's investigation since 21 February 2020," the decision states, and "the deletion of potential evidence after the commencement of an investigation cannot be invoked in Xandr's favour." Later it adds that Xandr "were aware of the investigation and thus cannot in good faith under the investigation period delete the underlying data pursuant to its data retention policies."

The burden of proof under the GDPR's accountability principle does rest on the company, and the authority was entitled to say so. The decision, however, records no instruction from Datatilsynet to preserve records, and no contact of any kind for more than two and a half years after Xandr's first reply. When the authority came back in 2023, Xandr said its business relationship with Grindr had ended in October 2021 and that certain information "appeared to no longer be available." The data agreement it eventually produced was a template, not the signed version in force at the time.

The cost shows up in the findings. "The NO DPA does not know how many bid requests related to Grindr users Xandr received or shared during the investigation period," the decision states. As a result, the number of people affected was given no weight in deciding whether to fine. The authority's press release today nonetheless quoted Director General Line Coll as saying "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."

Same complaint, different clock

Datatilsynet has handled a nearly identical case at a very different speed. The Consumer Council's complaint against Grindr arrived the same day as the one against Xandr, January 14, 2020, and concerned the same data flow in the same app.

In January 2021, about a year later, PPC Land reported that the authority intended to fine Grindr NOK 100 million. The final decision, for NOK 65 million, is dated December 13, 2021 in the Xandr decision, 699 days after the complaint. (PPC Land's later coverage gives December 24, 2021.) Xandr's advance notification took 1,906 days.

Grindr's appeals then ran for almost four more years. The Privacy Appeals Board upheld the fine on September 27, 2023, the Oslo District Court on July 1, 2024, and the Borgarting Court of Appeal on October 21, 2025. The Xandr decision relies on those rulings throughout. It adopts the finding from the Grindr case that being identified as a Grindr user discloses a person's sexual orientation, along with the invalidity of Grindr's consents, cites the Court of Appeal on negligence and industry practice, and quotes it on the weight to give the EDPB's fining guidelines.

That reliance points to one possible explanation for the pace: the authority may have been waiting for the courts to settle the Grindr questions before finalising a decision built on them. The decision does not say so, and the sequence does not quite fit. The advance notification to Xandr went out on April 3, 2025, 201 days before the Court of Appeal ruled. The decision followed 346 days after that ruling.

No cross-border excuse

In Ireland and elsewhere, the GDPR's one-stop-shop is often cited as a reason for slow decisions. A lead authority must circulate a draft to its counterparts in other countries, consider objections and sometimes go to the European Data Protection Board for a binding ruling.

None of that applied here. Xandr told the authority in 2020 that its European offices were sales offices with no decision-making power, and Datatilsynet accepted that Xandr had no main establishment in the EEA. The decision concludes that "the cooperation mechanism set out in Article 56(1) and Chapter VII Section 1 of the GDPR does not apply," and that Datatilsynet was competent to act alone for Norwegian users. There was no draft to circulate, no objection to resolve and no board referral. The 2,453 days were spent inside one national procedure.

A long case changes what is being punished

The conduct Datatilsynet examined, Xandr's role in real-time bidding on Grindr traffic, ran from July 20, 2018 to April 7, 2020, a window of 627 days. The decision came 2,369 days after that window closed, nearly four times longer than the conduct itself.

The ratio is close to that of a recent Irish case. Ireland's Data Protection Commission fined Google €403 million in September 2026 over location practices in a 620-day window that closed on February 4, 2020. The decision came 2,421 days later, about 3.9 times the length of the window.

In the Xandr case, the world moved on in the meantime. Microsoft acquired the company on June 6, 2022, 874 days into the case. Microsoft shut the Invest DSP, formerly Xandr, on February 28, 2026, seven months before the decision. Because the relevant date for turnover is "when the fining decision is issued by the supervisory authority", the fine was calculated on Xandr's revenue for the year to June 30, 2025. Xandr objected that the authority had taken more than a year after the advance notification to decide. The objection was dismissed.

The Consumer Council had asked in 2020 for an order to erase the data and a ban on the processing. Xandr told the authority that any personal data it may have processed about Grindr users would have been deleted under its retention policy. The decision therefore ruled only on whether collecting and sharing the data was lawful. A fine is the only measure it imposes.

The pattern in PPC Land's record

The Xandr case is long but not unusual. PPC Land's coverage over the past five years documents a series of GDPR cases in which the gap between complaint and outcome runs to five, seven or eight years, and sometimes longer.

Ireland. The DPC asked Google for an urgent response on location tracking in August 2018. It opened an inquiry 538 days later and fined Google 2,421 days after that, without describing any objections from other authorities or a referral to the Board. A single access request that researcher Michael Veale sent to Facebook on May 25, 2018 led to an inquiry opened on July 27, 2018. The record shows an extended period of apparent inactivity from 2019 to mid-2021, explained in part by Covid-19 and several changes of lead investigator, before a draft report in January 2022 and a proposed fine of €360 million to €430 million in October 2025. Meta's judicial review froze the process until the High Court dismissed it on May 21, 2026. The decision is still not final.

Refusals to act. noyb filed its forced-consent complaint against Meta on the GDPR's first day, May 25, 2018. When the EDPB instructed the DPC to investigate Meta's use of sensitive data, the DPC sued the Board instead. On January 29, 2025, the EU General Court ruled that the DPC had acted unlawfully by refusing to investigate, and noyb's chairman Max Schrems said the case was starting again from the beginning after more than six years.

Cross-border machinery. A noyb complaint about the Belgian broadcaster VRT's cookie banner, filed in Austria on August 10, 2021, was transferred to Belgium in June 2023. Belgium circulated a draft in August 2025 proposing to dismiss it, Austria objected, and the dispute went to the Board. EDPB Binding Decision 1/2026 was adopted on May 28, 2026, nearly five years after the complaint, and sent the case back to Belgium to start again. A YouTube access request made on October 2, 2018 went from Austria to Ireland in January 2019. The DPC returned it on November 17, 2022, having declared itself not competent, and the Austrian authority decided in August 2025.

Ad tech's own standard. Complaints about IAB Europe's Transparency and Consent Framework, the system behind most consent management platform pop-ups in Europe, reached the Belgian authority in 2019. Its decision came on February 2, 2022. An appeal and a reference to the Court of Justice followed, and the Market Court had to restart its hearing from scratch in January 2025 because the bench had changed. On January 7, 2026, it annulled the regulator's validation of IAB Europe's action plan, and the underlying 2022 findings remain unresolved. The original bidstream complaints filed in Ireland and the UK on September 12, 2018 have no reported outcome.

German state authorities. In August 2021, noyb complained about "Pay or OK" banners on faz.net and t-online.de. The North Rhine-Westphalia authority acknowledged receipt, then said in November 2022 that it had never received the complaint, then issued a decision in May 2025 saying it could not yet decide. Hesse cited complexity and possible future guidelines. noyb sued both authorities on June 17, 2025. A complaint about the face search engine PimEyes, filed in Hamburg on July 31, 2020, produced a decision on November 7, 2025 that found the service unlawful but declined to act. noyb sued the Hamburg authority on April 30, 2026.

Faster cases exist. France's CNIL received a noyb complaint about Gmail advertising on August 24, 2022, investigated within weeks and fined Google €325 million on September 1, 2025, about three years later. Sweden's authority took from January 2019 to June 2023 on Spotify, and a court upheld that fine on June 3, 2025.

Why it takes so long: what the record shows

Regulators rarely explain individual delays. Datatilsynet does not explain its delays in the Xandr decision, and the DPC gave no explanation for the Google case. The broader record does show several recurring causes.

Too few people for the caseload

The EDPB's contribution to the GDPR evaluation, adopted on December 12, 2023, found that most supervisory authorities consider their human, technical and financial resources insufficient. Average complaint resolution ranged from about two months to 18 months depending on the country, and only about 1.3% of cases from 2018 to 2023 ended in a fine. European authorities now receive more than 100,000 complaints a year. Between 2020 and 2024 staff numbers rose by more than 25% in 14 member states, yet authorities still reported a shortage of specialised technical staff.

The national figures are stark. Bavaria's authority received a record 9,746 complaints and prompts in 2025, up 61%, and ended the year with 603 cross-border proceedings still open and 43 approved positions, with no further increases in its draft budget. Portugal's CNPD, with 36 staff and a paper-based process, issued two fines in all of 2025. Austria's authority cut most of its roughly 20 administrative internships from July 2025 and said delays were unavoidable. Belgium's, with about 90 staff, had its recruitment credits frozen through 2029. In 2021, the Irish DPC had 160 staff and a €17 million budget for the European operations of most large US technology companies.

PPC Land's coverage contains no figures on Datatilsynet's own staffing or budget, and the Xandr decision does not mention resources.

Procedures built around the right to be heard

A GDPR fine is treated as a criminal penalty under the European Convention on Human Rights, as the Xandr decision itself notes. That brings rights of defence: orders with deadlines, extensions, an advance notification, a reply, access to the case file. Every one of these appears in the Xandr chronology, and each added weeks or months.

The courts have also changed the rules while cases were running. Luxembourg's Administrative Court annulled Amazon's €746 million fine on March 12, 2026, because the regulator had never assessed intent or negligence, a requirement the Court of Justice confirmed in Deutsche Wohnen in December 2023, more than two years after the fine. The Xandr decision cites Deutsche Wohnen and makes an explicit finding of negligence. A regulator that takes time to get the reasoning right is less likely to see its fine annulled. That is a fair defence of thoroughness, though it does not account for years with no recorded activity.

Litigation that freezes the process

Companies can stop the clock themselves. Meta's judicial review held up the Veale inquiry for five months. TikTok's €530 million fine, decided on April 30, 2025 after an inquiry opened in September 2021, was challenged within a month, and the Irish High Court granted a conditional stay on November 13, 2025. On February 10, 2026 the Court of Justice ruled that companies can challenge EDPB binding decisions directly. The WhatsApp case behind that ruling dates from an inquiry opened in December 2018, and its merits are still to be heard. According to an Alliance Risk analysis, about 40% of the €7.1 billion in GDPR fines imposed since 2018 has been annulled or is under challenge.

No deadline in the law

The GDPR sets no time limit for an authority to decide a case. The EU's answer is a procedural regulation for cross-border cases. During the trilogue on it, the European Parliament proposed deadlines of three months for simple cases and nine for complex ones, while the Council suggested 33 months. noyb argued the result would slow procedures rather than speed them up. The final text, Regulation (EU) 2025/2518, was adopted on November 26, 2025 and applies from April 2, 2027. In 2025, the EDPB recorded 1,299 one-stop-shop procedures and 572 final decisions. The regulation is aimed at cross-border cases. A purely national case such as Xandr's would not have been in its scope.

Choices

Some delays are decisions. Hesse's authority deferred a ruling because guidelines might come in the future. Hamburg's found PimEyes unlawful and declined to act, citing the company's apparent base in Dubai. The DPC went to court rather than investigate as the Board had instructed. Schrems has attributed the German delays to political unwillingness to enforce the GDPR against media companies. That is an advocate's characterisation, but in each of these cases a court has been asked to compel the authority to act.

What Datatilsynet has not explained

The authority's press release today says the case started in 2020. It states that "the fact that the unlawful practice lasted for such a long time was considered to be an aggravating factor when assessing the amount of the fine." Xandr's conduct lasted almost two years. The press release does not mention that the length of the authority's own case handling was treated as a mitigating factor. Several questions remain open:

  • What happened on the file between July 16, 2020 and February 6, 2023, and why no order went to Xandr in that time.
  • Whether the authority waited for the Grindr appeals, and if so, why the advance notification went out before the Court of Appeal ruled.
  • Why it took 487 days to decide after Xandr's reply to the advance notification.
  • How large the delay discount was, and why the authority kept it after the Privacy Appeals Board changed its practice.
  • Why the decision records no instruction to preserve evidence after the first exchange.
  • How many staff and how much budget Datatilsynet had for cases of this kind during the period.

Xandr can still appeal within three weeks of receiving the decision. If it does, the case goes first back to Datatilsynet and then to the Privacy Appeals Board, and the Grindr case shows how long that route can take.

Why this matters for marketers

For the advertising industry, slow enforcement cuts both ways. A practice can run for years before a regulator rules on it. When the ruling does come, it can land on a company that has changed owners, closed the business line in question and lost the records it would need to defend itself. The conduct in the Xandr case was over before Microsoft bought the company. The liability arrived more than four years after the purchase. The legal analysis behind it rests on a 2024 Court of Justice ruling on joint controller status and on Grindr rulings that Norway's courts finished only in October 2025.

Publishers and smaller ad tech firms have made a further argument in the Google case: years of unenforced conduct shift revenue towards whoever keeps doing it. PPC Land's coverage of the 2,951-day Google case set out that argument from Digital Content Next's Jason Kint. The Xandr decision makes a version of the point itself when it counts financial benefit as an aggravating factor. A fine calculated in 2026 on conduct from 2018 to 2020, and then reduced for the regulator's delay, tests how much deterrence the system actually delivers.

Timeline

Summary

Who: Datatilsynet, Norway's data protection authority, and Xandr Inc., formerly AppNexus and owned by Microsoft since June 2022. The Norwegian Consumer Council filed the complaint. The comparison cases involve Ireland's Data Protection Commission, Belgian, German, Austrian, Swedish, French and Luxembourg authorities, the EDPB and the EU courts.

What: An analysis of the time Datatilsynet took to decide the Xandr case, based on the chronology in its own decision. The case ran 2,453 days from complaint to decision. Three stretches with no recorded step account for 1,702 of those days, and periods waiting for Xandr's replies for 397. The authority reduced the NOK 92 million fine for its own lengthy case handling, kept that reduction after the Privacy Appeals Board changed its practice, and held Xandr responsible for records deleted during the authority's longest silence.

When: The complaint was received on January 14, 2020, the decision is dated October 2, 2026, and the fine was made public today, October 12, 2026. The longest gap ran from July 16, 2020 to February 6, 2023.

Where: Norway, in a purely national procedure. The GDPR's one-stop-shop did not apply, because Xandr had no main establishment in the EEA.

Why: The case shows that delay in GDPR enforcement cannot always be blamed on cross-border cooperation or company obstruction. The broader record on PPC Land points to under-resourced authorities, procedures that favour appeals, litigation that freezes cases, the absence of legal deadlines until a procedural regulation applies from April 2027, and choices by some authorities not to act. For the advertising industry, the result is legal uncertainty that can outlast the conduct, the business line and the company's ownership.