The Xandr fine: responsibility does not travel with the bid request

Norway’s data protection authority, Datatilsynet, fined Xandr NOK 92 million (about EUR 8.6 million or USD 9.8 million) for passing Grindr users’ data through its real-time bidding exchange without a legal basis. It is the largest fine Datatilsynet has ever issued, it became final on November 3 when Xandr let the appeal deadline pass, and it went to the ad exchange, not the app.

Grindr itself was fined NOK 65 million (about USD 6.9 million) in 2021 for the same data flows, and that decision survived two appeals. Five years later the authority came back for the intermediary that received the data, found it was a joint controller with the app, and rejected its defense that it had assumed the app obtained consent. For anyone who runs a mobile app with advertising in it, or sells the inventory, the principle Datatilsynet’s Director General set out below should shape compliance planning for 2027.

The case starts in January 2020, when the Norwegian Consumer Council filed complaints, with noyb, against Grindr and five adtech companies its Out of Control report had found receiving data from the app, among them Twitter’s MoPub, OpenX and AppNexus. AppNexus was renamed Xandr in 2019 and bought by Microsoft in 2022.

Timeline

• July 2018 to April 2020: The period Datatilsynet examined
• January 14, 2020: The Norwegian Consumer Council and noyb file complaints against Grindr and five adtech companies
• December 15, 2021: Datatilsynet fines Grindr NOK 65 million
• June 2022: Microsoft completes its acquisition of Xandr
• September 2023 to October 2025: The Grindr fine is upheld by the Privacy Appeals Board, Oslo District Court and the Borgarting Court of Appeal
• October 2, 2026: Datatilsynet fines Xandr NOK 92 million
• November 3, 2026: The Xandr decision becomes final

The mechanism is ordinary programmatic advertising. When a user opened Grindr, the app’s advertising SDK sent a bid request to Xandr’s exchange. Xandr relayed it to bidders, potentially thousands of them, who decided in milliseconds whether to buy the impression. The request carried, at minimum, the user’s mobile advertising ID (a fixed, device-level identifier that every app on the phone can read, so it links the same person’s activity across all of them), IP address and the fact that it came from Grindr. Datatilsynet held that the last item is itself data about sexual orientation: knowing someone uses Grindr says something about who they are, which puts the whole transmission under GDPR Article 9, the rule for special categories of personal data, and requires explicit consent.

The authority examined the period from July 2018 to April 2020, the stretch before Grindr changed its consent flow, and found Xandr had no legal basis for any of it. Xandr’s position was that Grindr, as the app, had collected user consent and Xandr was entitled to rely on it. The authority’s answer was that the consent did not exist (the 2021 Grindr decision had already established that) and that Xandr had never checked. Xandr also told the authority its records of the period had been deleted under its retention policy, so the exact count of affected users was never established; Datatilsynet says thousands of users in Norway were exposed and placed no weight on the precise number. It fined on the seriousness of the conduct, its duration, and the fact that Xandr earned revenue from every request it relayed.

The fine was calculated on Xandr’s own turnover, not Microsoft’s, because the conduct predates the acquisition. Xandr had three weeks to appeal. It did not, and on November 3 Datatilsynet updated its notice to say the decision is final.

One of the largest enforcement actions aimed at an app’s advertising supply chain. Most GDPR fines of this size have been about websites, platforms or data brokers. This one is about an SDK inside an app sending bid requests. Mobile advertising runs on exactly that pattern, in nearly every free app on either store, and until this decision the enforcement record for it was thin.

A Nordic authority protecting a vulnerable group. Grindr’s users are overwhelmingly gay, bisexual and trans men, and Datatilsynet has treated use of the app as sexual orientation data since 2021. The decision fits a wider Nordic pattern. In 2025 Datatilsynet audited tracking pixels on six sites chosen for their visitors, among them the national helpline for abused children, health sites and the Bible Society. All shared data without a legal basis, and the helpline’s operator was fined. Sweden’s IMY fined two pharmacies SEK 45 million (about USD 4.6 million) over Meta pixels reporting STI treatment purchases, and Denmark ordered 53 municipalities to stop sending pupils’ data to Google without a legal basis. The Nordic authorities have a consistent record here: they define the harm by what the data reveals about the person, regardless of what the sender intended to do with it.

Sensitive data moving through a supply chain nobody controls end to end. Because a bid request is broadcast, it can reach far beyond the app: Xandr’s third-party list had more than 4,000 companies on it. The authority found that the data went to an unknown number of them, and that this uncertainty counted against Xandr rather than for it. Once Article 9 data is in the stream, every hop is a transmission that needs a basis, and no participant can see the whole stream.

Liability on the vendor, as joint controller. Grindr paid NOK 65 million for collecting without consent; Xandr paid NOK 92 million for relaying without checking. As a joint controller on both sides of its exchange, Xandr’s liability is its own, not derived from the app’s. The precedent is Criteo, fined EUR 40 million (about USD 44.6 million) by France’s CNIL in 2023 partly for failing to show that its partners’ consent was valid. That decision stood largely alone for three years, until a second authority applied the same reasoning elsewhere in the stack and fined the vendor more than the app. We expect more: both cases came from campaign-group complaints, the 2020 complaint named four other adtech firms, and noyb calls this a precedent. Vendors fed by sensitive apps or sites are the most exposed.

Xandr’s defense is the defense the entire programmatic industry runs on. The publisher collects consent, the consent string travels with the bid request, and downstream parties read the string and act on it. Each party is responsible for its own step and relies on the party before it for the rest.

Datatilsynet’s answer was that reliance is not a legal basis. Xandr had taken no steps to confirm that valid consent existed. It did not audit Grindr’s consent flow, did not test what the SDK sent, did not ask whether a general-purpose consent dialog could carry Article 9 data. The decision’s phrase, in its section on accountability, is that compliance can never be outsourced: where one controller is tasked with collecting consent, both remain responsible for ensuring that consent is valid for their own processing. The authority found the infringement at least negligent on that ground.

What the authority expects an intermediary to do is not spelled out as a checklist, but the decision implies it. Know what categories of data arrive in your requests. Know which sources are sensitive by their nature, and treat an app whose name reveals a protected characteristic as one of them. Confirm that the consent you are relying on was actually obtained, in the form the data requires. Keep the records that would let you show what you received and from whom. Xandr’s deletion of its own logs under a retention policy did not help it; the authority said as much.

Two observations for US readers. First, this is the same analysis the California Attorney General applied to Lyft on October 29 on the other side of the transaction: the mechanism has to work, and the party relying on it has to be able to show that it does. Second, the IAB’s consent framework was not a defense here, because the authority did not ask whether a string was present; it asked whether valid consent stood behind it.

The decision is addressed to an ad exchange, but the lesson runs in both directions. The authority looked at what actually passed between the app and the exchange, and fined the party that could not show a basis for its part of it. An app owner sits at the other end of the same transmission, with the same question to answer, and the authority has just said that neither party gets to point at the other.

In practice that means three things most app owners cannot currently answer from their own systems.

Which SDKs in the app send data to third parties, and to which ones. The SDK list in the build is only a starting point, because advertising SDKs call out to exchanges, and exchanges relay onward. The 4,000-company bidder list in Xandr’s case was Xandr’s list, not Grindr’s, and Grindr almost certainly never saw it.

What those SDKs send. The advertising ID and IP address are the floor; Grindr’s own privacy policy at the time listed location and demographic information as shared with advertising partners too. The authority found that Xandr received the app name, the advertising ID and the IP address, and that was enough. For a health, dating, finance or children’s app, the app’s own name is a special-category disclosure, and the request carries it on every open.

Whether any of it is gated by consent, and whether the gate holds. A consent dialog in the app is only a UI element; whether the SDK waits for it, and stops when the user declines, is a network question that only a device capture answers. The scale of what leaves the device is larger than most app owners expect. In the apps Vault JS monitors on real devices, a single session routinely contacts many distinct third-party hosts: attribution SDKs, engagement platforms, analytics, session replay, ad endpoints. Each of those is a recipient under the GDPR, and each is one you need to be able to account for.

While the European side of this is now settled law, the US side is arriving by a different route: the Lyft and Disney orders were about in-app opt-outs that did not work, and the mechanism the regulator tested was the same one. One monitoring program across both is less work than two, and it is the most reliable way to have the evidence the authority expects before the authority asks for it.

Install your own app on a clean device. Open it, do nothing else, and capture the network traffic. List every third-party host that received a request before any consent dialog was answered. Then decline everything in the dialog and repeat. What still fires after the refusal is the Xandr fact pattern, from the app’s side.

If the app’s name or purpose reveals a protected characteristic, a condition, a faith, an orientation, a financial situation, the first list is already an Article 9 transmission. At that point, the design of the consent dialog matters less than whether anything at all left the device before the user said yes.

A privacy notice describes what the app is supposed to do, while a network capture shows what it actually does. Datatilsynet fined Xandr over what actually moved through its exchange, and that gap between intended and actual behavior is something every app owner can measure.

This article describes a published regulatory decision and what it means in practice for teams that operate mobile apps. It is not legal advice. Decisions about your own legal basis, controller status or consent flows should be made with your counsel.

A note on controller status. Datatilsynet found Xandr to be a joint controller with Grindr for the data in the bid request. The decision does not rule on an app owner’s status for what its own SDKs send onward, but the reasoning is symmetrical: if the exchange is a joint controller for what it receives, the app is exposed on the same footing for what it sends. Whether that holds for a particular app, and what it requires, is a question for your counsel.