On 2 October 2026 the Norwegian Data Protection Authority (Datatilsynet) fined Xandr Inc., the advertising unit now part of Microsoft, NOK 92 million, which it puts at EUR 8.6 million. The authority's announcement calls it the highest fine it has issued to date. The EDPB published its summary on 16 October. The case is a useful test of how far GDPR responsibility reaches down an advertising supply chain.
What the authority found
The case began with a 2020 complaint from the Norwegian Consumer Council. According to the EDPB summary, Xandr, formerly AppNexus, processed Grindr users' app use, advertising ID and IP address during real-time bidding (RTB). The DPA treated that data as revealing sexual orientation, so Article 9(1) GDPR applied on top of Article 6(1). Xandr did not collect consent itself. It relied on the consent Grindr had gathered, and the DPA held that consent invalid under Articles 4(11) and 7. The processing ran from July 2018 to April 2020, according to the DPA, and Xandr was found to be a joint controller with Grindr, acting as both supply-side and demand-side platform.
The EDPB's summary puts the principle this way: accountability cannot be outsourced, and each joint controller must independently verify that consent is valid and covers its own processing. The DPA called the infringements at least negligent and of high seriousness. Datatilsynet says it calculated the fine on Xandr's own turnover, not Microsoft's.
The strongest case for the decision
The regulator's position deserves a fair statement. Sexual orientation is among the data where leaks cause the gravest harm, and in some countries it can endanger lives. A user who taps through a dating app's consent banner cannot know that identifiers will be broadcast to a bidding network. If a downstream company could treat the upstream app's banner as a permanent shield, nobody in the chain would have an incentive to look at what the banner actually said. The rule that every controller checks its own legal basis is the straightforward reading of Articles 6 and 7, not a regulatory novelty. Microsoft's reported response, that the conduct predates its acquisition of Xandr, is a point about corporate history, not about whether the users were harmed.
Where the decision is sound
The fine is proportionate by the standards of the regulation. It targets a clear category-of-data failure rather than a technical formality, and it follows a prior penalty on Grindr itself. Datatilsynet fined Grindr NOK 65 million in 2021 for equivalent breaches, and that was upheld by the Borgarting Court of Appeal. Pro-innovation policy needs enforcement of this kind: regulation aimed at sensitive-data misuse is more credible, and less likely to be swept into broad restrictions, than rules that treat all advertising data alike. Xandr did not appeal, according to a 3 November update on the DPA's page, so the decision is now final. That means the legal theory will not be tested in a Norwegian court.
Where the problem remains
That last point matters. The principle that each recipient must verify consent is clear on paper, but the DPA's own announcement refers to potentially thousands of other companies in the RTB chain. A bid request is auctioned in milliseconds. A demand-side platform has no practical way to audit an app's consent flow before each auction, so in practice it would have to depend on contracts, signals and audits, which is the kind of reliance the decision treats as insufficient. The ruling says what is forbidden but gives little operational guidance on what counts as sufficient independent verification.
That gap has a cost. Large firms can build compliance teams and drop risky inventory. Smaller European ad-tech firms and publishers cannot, and they may simply exit the sensitive-category market or the EU market. The most likely beneficiary is the largest players with first-party data, which is the opposite of the competition outcome European policymakers say they want.
The timeline also undermines deterrence. The complaint was filed in 2020 and the decision came in 2026, six years later, for conduct that ended in April 2020. Enforcement that arrives long after the practice has changed teaches the industry less than guidance published at the time would have.
What would make enforcement work
Three changes would help without weakening protection:
- Publish verification standards. The EDPB should issue guidance on what an RTB participant must check, such as signed consent records, purpose-specific signals and sampling audits, so that compliance is something a company can achieve.
- Prioritise sensitive categories. Resources should go to cases involving health, sexuality, religion and children, as here, rather than to routine cookie-banner disputes.
- Speed up cross-border cases. Where a ruling shapes a whole industry, regulators should aim for a decision within a couple of years, not six.
The Xandr decision is correct that responsibility cannot be passed along a chain like a parcel. What the industry still lacks is a clear statement of the steps that discharge it. Until the EDPB or the courts supply one, the fine will prompt compliance mainly through caution, and caution is a poor substitute for a standard.