What happened
The underlying processing occurred from July 20, 2018 to April 7, 2020; the Norwegian decision was dated October 2, 2026 and announced on October 12, 2026. Datatilsynet fined Xandr NOK 92 million, approximately $9.61 million in Reuters’ conversion, for unlawfully processing and relaying Grindr users’ sensitive data in real-time bidding. Xandr has three weeks from receipt of the decision to appeal.
The decision treated Xandr as a joint controller operating on both the supply and demand sides of the advertising market. The regulator found that use of Grindr, advertising IDs and IP addresses constituted personal data concerning sexual orientation for the relevant processing. It rejected Xandr’s reliance on Grindr’s consent practices and treated independent verification of lawful processing as the intermediary’s responsibility.
PPC Land reported that the 54-page decision found Xandr deleted processing documentation after it knew it was under investigation. The fine used Xandr’s turnover rather than Microsoft’s because Microsoft acquired Xandr after the conduct. No technical indicators of compromise, malware artefacts or exploit telemetry apply to this regulatory matter. Attribution posture: This is a regulatory decision about controller responsibility; no threat actor attribution applies. The cited source did not publish the specific indicators described as Technical indicators.
Why this matters now
The decision targets an intermediary rather than only the consumer-facing application. That matters to enterprises using advertising, analytics, identity-resolution and data-broker ecosystems because contractual language cannot automatically transfer statutory accountability. Each participant may need to establish its own lawful basis, special-category condition, transparency and consent evidence for the processing it determines.
The finding concerning deleted processing documentation raises a separate governance issue. Regulatory readiness depends on preserving records, decision logs and technical evidence once an investigation is known or reasonably anticipated. A privacy programme that can map data flows but cannot place processing documentation under legal hold may lose the evidence needed to defend controller roles, historical practices and remediation decisions.
The decision for security leaders
Ask the DPO and legal team to identify data ecosystems where the enterprise relies on another participant’s consent representation. Require evidence showing what each intermediary receives, decides, enriches and shares. Contractual allocation remains useful for recourse, but it should not be treated as proof that the enterprise or its providers have met independent controller duties.
Extend incident-style evidence preservation to regulatory investigations. Processing records, consent artefacts, bid-request schemas, retention settings, contracts and decision logs should enter legal hold before routine deletion continues. Where historical evidence is unavailable, document the limitation, stop unsupported processing and establish a defensible remediation record rather than recreating certainty that does not exist.
Evidence of closure
- Approved data-flow records identify intermediaries, fields, purposes and controller roles.
- Consent validation records cover each controller’s processing of special-category data.
- Legal-hold controls preserve relevant processing records across internal and vendor systems.
- Remediation decisions document stopped processing, contract changes and unresolved historical limitations.
The Security.io assessment
The ruling’s enterprise significance lies in the refusal to let a data intermediary outsource accountability to the application that initiated the transaction. That reasoning can affect complex chains in which several parties determine purposes or means while relying on upstream consent signals. Security and privacy architecture should therefore expose controller decisions and consent dependencies as governed control points, not bury them inside vendor contracts.
The documentation finding also joins privacy governance with evidence management. Organisations need deletion controls capable of recognising investigations, complaints and legal holds across privacy platforms and vendor-held records. Because the decision may be appealed, its final legal scope is not settled; however, waiting for final appeal exhaustion would leave current data-flow and preservation weaknesses unaddressed.
Questions for the morning meeting
- Which intermediaries independently validate consent for their own processing of special-category data?
- Can the organisation preserve processing records immediately when a regulator or litigant places them in scope?
- Do contracts incorrectly assign controller accountability to another participant in the data chain?