The full decision behind Norway's NOK 92 million fine on Xandr runs to 54 pages, and it contains findings that the Norwegian Data Protection Authority's announcement left out. Dated October 2, 2026 and signed by Director General Line Coll and Head of International Tobias Judin, the decision finds that Xandr, now part of Microsoft, deleted documentation about its processing of Grindr users' data while it knew it was under investigation. It concludes that Xandr was a joint controller as both a supply-side and a demand-side platform, that the fact of using Grindr is data concerning sexual orientation, and that the infringements were at least negligent. It also converts the fine to approximately €8.5 million, not the €8.6 million stated in the authority's press release.

In Short

Norway's privacy regulator has now published the full reasoning behind its NOK 92 million fine on Xandr, an ad tech company that passed along information about people using the gay dating app Grindr. The document shows Xandr argued it was only following Grindr's instructions and that Grindr was responsible for getting consent, but the regulator said Xandr made its own decisions about the data, profited from it, and could not hand off its legal duties by contract. It also shows Xandr deleted records while the investigation was running, that the fine was set on Xandr's own revenue rather than Microsoft's, and that Xandr can still appeal to Norway's Privacy Appeals Board.

What the full decision adds

PPC Land reported the fine earlier today based on Datatilsynet's announcement and a media update from noyb. The announcement described the infringement in general terms and cited no articles of the GDPR. The decision itself is specific.

According to the executive summary, the authority imposed the fine "for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR." The fine is imposed under Article 58(2)(i), read with Article 83.

The authority found it "proven by clear preponderance of probability" (in Norwegian, klar sannsynlighetsovervekt) that Xandr processed "at least the fact that individuals were using Grindr, their advertising ID and IP addresses" during real-time bidding. Those data, it held, are personal data under Article 4(1) and data concerning sexual orientation under Article 9(1).

The summary then sets out the principle on which the rest of the decision turns: "The NO DPA holds that accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing."

The copy of the decision reviewed by PPC Land carries a header marking it as exempt from public disclosure under section 13 of the Norwegian Freedom of Information Act, and several passages are blacked out. The redactions include Xandr's revenue figures, the fine as a percentage of turnover and part of the discussion of how Xandr used data to improve its platform.

Nearly seven years from complaint to decision

The decision gives a precise chronology. The Norwegian Consumer Council's complaints against Grindr, Xandr and four other ad tech companies reached Datatilsynet on January 14, 2020. The Council acted on behalf of a Norwegian data subject under Article 80(1). The complaint against Xandr was originally filed against AppNexus Inc.

The corporate history matters to the outcome. AT&T closed its acquisition of AppNexus on August 15, 2018. AppNexus was renamed Xandr Inc. on July 1, 2019, and Microsoft acquired Xandr on June 6, 2022, according to the decision.

The investigation period runs from July 20, 2018, the date the GDPR entered into force in Norway, to April 7, 2020. The end date is tied to Grindr: its new consent management platform went live for Norwegian users on April 8, 2020, so the authority limited the inquiry to the period when Grindr's previous consent mechanism was in use. The technical evidence came from tests run by the Norwegian security firm mnemonic between July 8 and December 31, 2019, commissioned by the Council for its "Out of Control" report.

The steps between those points, as the decision lists them:

  • February 21, 2020 - Datatilsynet orders Xandr to provide information on cross-border processing. Xandr asks for more time, and the deadline moves from March 16 to July 17, 2020.
  • July 16, 2020 - Xandr responds.
  • February 6, 2023 - Datatilsynet sends a second order on the processing of data shared by Grindr. Owing to a change in staff, the letter does not reach the right person at Xandr until March 28, 2023.
  • May 26, 2023 - Xandr answers after two extensions. It had told the authority that its business relationship with Grindr ended in October 2021 and that some information "appeared to no longer be available."
  • August 23 to October 2, 2023 - Exchanges over the International Data Addendum between Grindr and Xandr and Xandr's relationship with MoPub. Xandr supplies a template rather than the signed agreement.
  • November 27 to December 20, 2024 - A further order on the temporal scope, data flows and matching process.
  • February 27, 2025 - A voluntary online meeting between the authority and Xandr to establish the facts.
  • March 18 and 25, 2025 - The authority orders and receives turnover figures.
  • April 3, 2025 - Datatilsynet sends an advance notification of its intention to fine.
  • June 2, 2025 - Xandr replies with its comments and new turnover information.
  • June 3 and 15, 2026 - The authority requests and receives updated turnover figures.
  • October 2, 2026 - The decision is dated.

The authority took 16 months between Xandr's response to the advance notification and the final decision. That delay would later reduce the fine.

How Xandr sat on both sides of the auction

Section 6 of the decision opens with a primer on real-time bidding and then reconstructs, from a data flow overview Xandr supplied in December 2024, how the process ran for Grindr. The authority describes six steps:

  1. A user opens the Grindr app, and an ad slot triggers an ad request.
  2. The ad request reaches Xandr's platform either directly from Grindr or through MoPub, the ad mediation service whose software development kit was built into the app.
  3. Xandr shares elements of the request with third-party segment data providers "to enrich the bid request with information about which segment(s) a user belongs to."
  4. Xandr shares elements with real-time and contextual data providers, which could return, for example, the time or the weather at the user's location.
  5. Xandr sends a bid request, following the OpenRTB protocol, to its own demand-side platform and to third-party DSPs.
  6. Bidders evaluate the request, and the winning ad is delivered to the app.

Xandr played two roles in this chain. Where Grindr was a "Direct Client," Xandr acted as the supply-side platform selling Grindr's inventory. Where requests came through MoPub, which the decision says listed more than 160 demand-side and mediation partners and named Xandr as an "Advertising Demand Partner," Xandr acted as a DSP. Xandr also confirmed that its own ad buying platform bid on Norwegian Grindr users in both cases.

What was in the bid requests

Xandr told the authority it could not identify or verify which personal data of Grindr users it had processed. It did confirm that it "processed data contained in those bid requests to display ads to Norwegian users of the Grindr app." The mnemonic tests showed Xandr receiving the app name, the advertising ID and the IP address. Grindr, answering the complainant's access request, said it shared IP addresses and Google Advertising IDs "if allowed by user" with Xandr.

One detail contradicts what MoPub told publishers. According to the decision, MoPub's documentation said its SDK pseudonymised or truncated the IP addresses of users in the EU and EEA. The technical testing "showed that the MoPub SDK was transmitting the full IP address to Xandr."

Xandr argued that because it no longer held information about which data it processed, the authority should assume it did not process particular data points. It also argued that the app, device and user fields in OpenRTB 2.4 are only recommended, not required. The authority accepted that the fields are not strictly required but said "they are integral to making the services profitable." It noted that in the February 2025 meeting Xandr had confirmed that the IP address, mobile advertising ID and app URL would be shared with third-party DSPs, and that Xandr later "altered its position" to say it had no evidence it shared Norwegian Grindr users' data with third parties.

Xandr's own privacy policies at the time described the sharing. The version updated on October 24, 2019 said Xandr could share data with third-party providers "so that they can decide whether to bid on ad inventory or serve an advertisement," "so that certain of them can create demographic and interest profiles," and "so that they can improve their products and services for use by us and others across the broader online advertising ecosystem."

The deleted records

The most pointed passage in the decision concerns evidence. Xandr was unable to produce certain documentation, arguing that it had been deleted under its legal obligations and data retention policies between July 16, 2020 and February 6, 2023. According to the authority, "This deletion occurred notwithstanding that Xandr had been aware of the NO DPA's investigation since 21 February 2020."

Datatilsynet refused to let the gap work in Xandr's favour. "The NO DPA takes the view that the deletion of potential evidence after the commencement of an investigation cannot be invoked in Xandr's favour," the decision states. The burden of demonstrating compliance under Article 5(2) rests on the controller, and "Any alternative approach would establish an unacceptable precedent, as it would in practice incentivise undertakings to erase documentation in order to circumvent supervision by data protection authorities."

The point returns later, when Xandr asked for the fine to be cut or eliminated because the authority's delays had harmed its ability to defend itself. The authority rejected that claim, writing that Xandr was "aware of the investigation and thus cannot in good faith under the investigation period delete the underlying data pursuant to its data retention policies."

Xandr also told the authority that it had searched its systems and found none of the personal data it had processed for Grindr, because that data would have been deleted under retention rules for advertising transactions.

Why Xandr was a controller, not a processor

Xandr's central argument was that, as an SSP, it processed Grindr data mostly as a processor following Grindr's instructions. According to Xandr, Grindr and MoPub "had access to controls allowing them to select the precise categories of data included in ad calls and the precise recipients of data. Xandr would not have had any role in those decisions." Those controls sat in Xandr's Console, where clients could switch off data elements such as location or block particular DSPs or categories of advertiser.

The authority dealt with the two roles separately.

As a DSP, the question was largely settled by Xandr itself. In a submission dated October 2, 2023, Xandr confirmed it was a joint controller with Grindr when its own buying platform bid on Grindr users. It listed the purposes: bidding on inventory by checking whether a device belonged to interest segments, delivering ads using the device's advertising ID and IP address, measurement and attribution reporting, and frequency and recency capping. In its 2025 response, Xandr said it did not create the segments it offered, which came from third-party providers. The authority replied that buyers "could select segments from a standard that Xandr made available for them to choose from, thereby Xandr did influence the processing."

As an SSP, Xandr accepted it was a controller for frequency capping, security, fraud detection and platform improvement. In July 2020 it had told the authority that "personal data is also processed in the course of training Xandr's ad delivery and bidding algorithms in order to improve overall platform optimization." In its 2025 response, it said there was no evidence it processed Norwegian Grindr users' data for that purpose. The authority said the later statement "seems to be in direct contradiction to what Xandr stated in the beginning of the investigation."

On the processor claim, the authority made four points:

  • Xandr set the framework. Grindr could block data points or blacklist DSPs, but "it was Xandr that provided the framework for exercising such choice." Where Grindr did not change the settings, "the bid request would be circulated according to the standards selected by Xandr to the recipients that Xandr had partnered up with."
  • Xandr's own contract instructed Grindr. Xandr argued that clause 6.1 of its standard Master Service Agreement prohibited Grindr from sending special category data. The authority turned this around: such a clause "entail[s] that Xandr did instruct Grindr on the categories of data shared with it."
  • Enrichment served Xandr. Xandr enriched ad requests before sending bid requests, "both the enrichment and dissemination being equally in Xandr's interest as in Grindr's."
  • Nobody accepted responsibility. Grindr told the authority in 2021 that "Grindr and Xandr [did] not have a controller-processor relationship as regards the personal data in question." With Xandr calling itself a processor and Grindr denying it, "data subjects' rights would be entirely undermined."

The authority relied heavily on the Court of Justice's March 2024 judgment in Case C-604/22, IAB Europe, which held that participation in setting purposes and means can come from "converging decisions" that each have "a tangible impact." It concluded that "Xandr had tangible impact on the determination of the purposes and means of the processing by providing the framework and presenting the Console with the standard selected by Xandr." That is the same judgment that, as PPC Land reported in May 2025, treated TC Strings as personal data and led a Belgian court to limit IAB Europe's joint controllership.

The decision also describes the industry in unusually direct terms. "The AdTech industry is particularly opaque and consists of a large number of companies exchanging personal data about troves of data subjects along complex value chains," it says. If each company were not held responsible, "it would lead to a diffusion or even elimination of responsibility, rendering the data subject's rights illusory."

Sexual orientation from an app name

The authority did not reargue whether Grindr use indicates sexual orientation. It adopted its December 2021 conclusion against Grindr, which was upheld by the Privacy Appeals Board, the Oslo District Court and the Borgarting Court of Appeal. The district court had found that by sending the app ID, Grindr told advertisers the data came from a registered Grindr user, which is information about sexual orientation.

Xandr's answer was that it had no reason to know. It said it was not aware of regulatory guidance stating, "and certainly it was not market practice to consider," that being a Grindr user could in itself be special category data, and that the question was unclear enough to have reached the Court of Justice in cases decided after the investigation period.

The authority rejected both points. It said Xandr's narrow reading "appears to have no support in legal sources," cited the Court of Justice's broad interpretation of sensitive data in OT (C-184/20), Meta v Bundeskartellamt (C-252/21) and Lindenapotheke (C-21/23), and added that "CJEU judgements apply retroactively (ex tunc)." Citing Meta v Bundeskartellamt, it also held that it does not matter whether a controller is aiming to obtain sensitive information.

Only two exceptions in Article 9(2) were considered. Article 9(2)(e), data manifestly made public by the person, was ruled out on the same reasoning as in the Grindr case. That left explicit consent under Article 9(2)(a).

"It is undisputed that Xandr never obtained any consent directly from the data subjects," the decision states. Xandr relied on Grindr to decide whether consent was needed and contractually obliged it to obtain valid consent. A similar clause existed in Xandr's data processing agreement with MoPub.

Grindr's consents, collected through its previous consent management platform, had already been found invalid: not freely given, specific, informed or unambiguous, and not as easy to withdraw as to give, under Articles 4(11) and 7. Three bodies upheld that conclusion.

The authority held that one controller may collect consent for another only if both ensure it meets every requirement, "including that it is properly documented and covers the specific processing activities of both of them." Grindr's responsibility for collecting consent did not relieve Xandr of its own duties under Articles 5(2) and 24, or of its obligation under Article 7(1) to be able to show that consent was given. "Xandr did not take any measures, in order to discharge of its accountability obligations, to verify that consent was valid and that it covered its processing activities," the decision states. Of the contractual prohibition on sensitive data, it said "such a formality in the form of a contractual commitment between controllers does not relieve Xandr of its responsibility, when it de facto processed sensitive personal data."

The Article 6 finding contains a further detail. Xandr did not answer the authority's question on whether it relied on legitimate interest under Article 6(1)(f). It referred instead to its privacy policy, which said "[w]e normally rely on legitimate interests to collect and use personal data" and that "[in] some cases, we may rely on your consent which is obtained for us by the operator of the Digital Properties." The authority found the policy "too vague" and noted that Xandr "has not in plain text confirmed" which legal basis it used. Because the data was special category data, it held that consent was the only available basis under Article 6(1) in any case.

At least negligent

A GDPR fine in Norway requires intent or negligence. The decision notes that an administrative fine is a criminal penalty under the European Convention on Human Rights. The authority found the infringements "at least negligent." It did not make a finding of intent.

Xandr said it was not aware it was processing special category data and that it would have been "unfeasible" for it to check whether a customer's legal basis was valid. The authority replied that Xandr "devised a system in which it effectively outsourced the necessary assessments" and that because Xandr had no direct contact with users and sat "further down the chain," it "had all the more reason to check and ensure lawfulness." It pointed to Article 29 Working Party guidance on consent that was available at the time.

The decision relies on the Borgarting Court of Appeal's Grindr judgment, in which the court said that, given the sensitivity of the data, a lack of knowledge about what information is shared and how a consent mechanism is designed "would in any case constitute gross negligence." It also cites a Norwegian Supreme Court ruling that anonymous and cumulative failures by staff can meet the culpability requirement, and the Court of Justice's Deutsche Wohnen judgment that management need not have known.

How NOK 92 million was reached

Microsoft's turnover, then not

The decision reasons in two stages on whose revenue should count. Citing ILVA (C-382/23) and the EDPB's fining guidelines, it says that a parent holding all or almost all of a subsidiary's shares is presumed to exercise decisive influence over it. "Xandr is now owned by Microsoft... Therefore, in this case, the administrative fine should be calculated - at least as a starting point - on the basis of a percentage of Microsoft's annual turnover."

The authority then departed from that starting point. Microsoft "was not in a legal or factual position to exercise decisive influence over the conduct of its now subsidiary" during the investigation period. Drawing on the Court of Justice's competition law judgment in YKK (C-408/12 P), which concerned a company acquired after an infringement, the authority concluded that it "would not be appropriate or proportionate to base a fine on the turnover of Microsoft, nor would it be necessary to do so in order to ensure that the fine is effective and dissuasive."

The ceiling and the conversion

Xandr's revenue figures are redacted. The decision states that Xandr's financial year 2025 ran from July 1, 2024 to June 30, 2025, and that "EUR 20 000 000 is higher than 4 % of Xandr's total worldwide annual turnover." The legal maximum under Article 83(5) was therefore the fixed €20 million, which the authority converts to approximately NOK 215,800,000 and $23,064,596 at Norges Bank rates for September 15, 2026 (10.79 kroner to the euro and 9.35 kroner to the dollar).

Two inferences follow from those statements, and both are PPC Land's arithmetic rather than figures in the decision. If 4% of Xandr's turnover was below €20 million, its worldwide turnover for that financial year was below €500 million. And NOK 92 million is about 42.6% of the NOK 215.8 million maximum.

Xandr objected to the use of 2025 revenue because the authority had taken more than a year after the advance notification to decide. The authority replied that, under competition case law also applied to GDPR fines, the relevant date is when the fining decision is issued.

At the 10.79 rate, the authority says, NOK 92 million "amounts to approximately EUR 8 500 000," within the €4 million to €20 million range that EDPB Guidelines 04/2022 set out for infringements of a high level of seriousness.

The factors

The authority assessed each Article 83(2) criterion. Its conclusions:

  • Aggravating: (a) nature, gravity and duration; (d) degree of responsibility; (g) categories of data; (k) financial benefit.
  • Mitigating: (f) cooperation, limited to Xandr's voluntary attendance at the February 2025 meeting, which the authority called "slightly mitigating"; (k) the length of the case handling.
  • Neutral or not applicable: (c) mitigation of damage, (e) previous infringements, of which the authority knew none, (h) how the infringement became known, (i) prior orders and (j) codes of conduct.

Several details sit under those headings. At the time, Xandr's published list of third-party providers included "more than 4000 companies," including bidders and real-time data providers, and the authority said that the inability of users to know which companies received their data "adds to the gravity of the infringement." It cited its own 2024 privacy survey, in which 39% of respondents were very negative and 28% somewhat negative about personal data being used to target ads, and a YouGov survey for the Consumer Council with figures of 30% and 22%.

On financial benefit, the authority said Xandr "must have gained financial benefits from the infringements" and that with informed, freely given consent "it is likely that at least some users would not have agreed to the processing." It cited the Court of Appeal's view that industry practice cannot be a mitigating factor and that widespread breaches "reinforce the need for an administrative fine with a deterrent effect."

The number of affected users received no weight. "The NO DPA does not know how many bid requests related to Grindr users Xandr received or shared during the investigation period," the decision says, and therefore "does not know the exact number of data subjects affected by Xandr's processing."

The delay discount

The reduction for delay has an unusual history. Under the Privacy Appeals Board's practice when the advance notification was sent, long case handling counted as a mitigating factor under Article 83(2)(k). The Board later changed that practice, in decision PVN 2025-30. Datatilsynet nonetheless "decided to uphold what already was notified in this regard," and "the amount of the fine has been reduced in this case." The decision does not state the size of the reduction or the pre-reduction amount.

Why Norway acted alone

Xandr told the authority in 2020 that its establishments in the EEA were sales offices that did not decide the purposes and means of processing, and that it had no main establishment in the EEA. The authority accepted this. Without a main establishment, the processing was not "cross-border processing," and the GDPR's one-stop-shop cooperation mechanism did not apply. The Microsoft acquisition did not change that, because no Microsoft entity could have taken decisions about Xandr's processing during the investigation period.

As a result, Datatilsynet's competence covers only users in Norway. The decision states that it "is without prejudice to the competence of GDPR supervisory authorities in other EEA territories." It also reserves the authority's right to examine other issues later. Xandr said all Grindr data had been deleted, so the authority confined itself to the lawfulness of collection and sharing and did not rule on the Consumer Council's requests for erasure or a processing ban. The decision says that "the NO DPA has not conducted any legal assessments" of Grindr's or MoPub's activities in this case.

Where the decision and the press release differ

Reading the decision against Datatilsynet's October 12 announcement produces three differences.

  • The euro figure. The press release says NOK 92 million is "equivalent to €8.6 million." The decision converts it to "approximately EUR 8 500 000" at 10.79 kroner per euro, which works out to about €8.53 million. noyb's €8.5 million, which PPC Land's earlier article flagged as a discrepancy, matches the decision. The press release figure does not.
  • The number of users. The press release quotes Coll as saying "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data." In the decision, the reference to thousands describes sharing by Grindr to third parties, citing the Oslo District Court, and the authority states that it does not know how many users Xandr's processing affected and places no weight on the number.
  • The record. The press release calls NOK 92 million the authority's highest fine to date. The decision does not mention this. It does record that the Grindr fine of December 13, 2021 was NOK 65 million.

The decision also confirms details the press release rounded off. The infringement period is July 20, 2018 to April 7, 2020, not simply July 2018 to April 2020, and the complaint was received on January 14, 2020.

What happens next

Xandr may appeal within three weeks of receiving the letter, under chapter VI of the Public Administration Act. An appeal goes first to Datatilsynet. If the authority upholds its decision, the case goes to the Norwegian Privacy Appeals Board under section 22 of the Personal Data Act. A copy of the decision went to the Consumer Council (Forbrukerradet).

The Grindr case shows how far that route can run. Datatilsynet's December 2021 decision passed through the Privacy Appeals Board (PVN-2022-22), the Oslo District Court and finally the Borgarting Court of Appeal, which dismissed Grindr's appeal on October 21, 2025. The Xandr decision relies on that judgment at almost every stage of its reasoning, from the classification of the data to negligence and the weight of the EDPB's fining method.

Why the detail matters for advertising

The decision is narrower than the announcement suggested in one respect. It covers only Norwegian users and a period that ended in April 2020, and the business that carried out the conduct has changed hands twice. Microsoft closed the Invest DSP on February 28, 2026.

In other respects, it is broader. The reasoning applies to any company that supplies the infrastructure for a bid request. Three findings stand out:

  • Console controls are not instructions. A platform that offers clients controls to block data or bidders, but chooses the defaults and the list of possible recipients, shares in the determination of purposes and means.
  • Contract clauses are not compliance. A prohibition on receiving sensitive data and a clause requiring a partner to collect consent do not satisfy the recipient's own accountability. The French Conseil d'Etat reached a similar conclusion on consent when it upheld Criteo's €40 million fine in March 2026.
  • Retention policies do not run during an investigation. Deleting records after an inquiry starts cannot be used to argue that the authority lacks proof.

The finding that an app identifier can be special category data also reaches further than dating apps. The decision cites Court of Justice case law that sensitive data includes information "liable to indirectly reveal sensitive information," including visits to apps related to protected categories, "regardless of whether the information revealed is correct." Any bid request that carries an app bundle from a health, religious or similar app falls within that reasoning.

The Digital Omnibus negotiations in Brussels add a further layer. The decision's analysis rests on advertising IDs and IP addresses being online identifiers that make a person identifiable under Article 4(1), the definition that the EDPB and EDPS warned in February 2026 the Commission's proposal would "significantly narrow." The Council's negotiating mandate reported on October 9, 2026 keeps that change.

Timeline

Summary

Who: Datatilsynet, the Norwegian Data Protection Authority, through Director General Line Coll and Head of International Tobias Judin, and Xandr Inc., formerly AppNexus Inc. and owned by Microsoft since June 6, 2022. The Norwegian Consumer Council filed the complaint. Grindr and MoPub feature in the facts, but the decision makes no legal assessment of them.

What: A 54-page decision fining Xandr NOK 92 million, about €8.5 million at the decision's own exchange rate, for breaching Articles 6(1) and 9(1) of the GDPR. The authority found Xandr a joint controller as both SSP and DSP, held that being a Grindr user is data concerning sexual orientation, rejected Xandr's reliance on Grindr's invalid consents and contract clauses, and found the infringements at least negligent. It held that deleting documentation after the investigation began could not count in Xandr's favour. The fine was based on Xandr's turnover rather than Microsoft's, capped at €20 million, and reduced for delay.

When: The complaint was received on January 14, 2020, and the conduct covered July 20, 2018 to April 7, 2020. The advance notification was sent on April 3, 2025, the decision is dated October 2, 2026, and the fine was announced on October 12, 2026. Xandr has three weeks from receipt to appeal.

Where: Norway, which applies the GDPR through the EEA Agreement and the Personal Data Act. The decision covers only users in Norway and does not limit other EEA authorities.

Why: The decision explains in detail why an intermediary in real-time bidding cannot treat consent as its client's problem, why platform controls and contract terms do not turn a controller into a processor, and why a pre-acquisition infringement is measured against the acquired company's own revenue. It also shows that the authority's own press release used a different euro conversion from the decision.