
Bidding on Sensitive Data: Norway's Record Fine Against Xandr
The Norwegian Data Protection Authority (Nw.: "Datatilsynet") has, in decision 20/03541-37, imposed the largest fine in its history: NOK 92 million (approximately EUR 8.6 million) against Microsoft-owned AdTech company Xandr Inc. for unlawfully processing and sharing special categories of personal data about Grindr users through real-time bidding (RTB). The decision and the Authority's parallel public guidance illustrate its approach to programmatic advertising, joint controllership among AdTech intermediaries, and reliance on another party's consent mechanism.
29 October 2026 · Selmer · Norway























































