Datatilsynet decision dated October 2, 2026; announced October 12, 2026
Norway Fines Xandr EUR 8.6 Million: A Partner's Consent Is Not Your Consent
Norway's data protection authority, Datatilsynet, fined Xandr, the advertising technology company now part of Microsoft, NOK 92 million (listed by the European Data Protection Board as EUR 8.6 million) for processing Grindr users' data without a valid legal basis. The authority found that Xandr never collected consent itself and relied on consent Grindr said it had gathered, which did not meet the GDPR standard; that the mere fact of using Grindr, together with an advertising ID and IP address, counts as special category data under Article 9; and that Xandr was a joint controller whose contracts did not transfer its accountability. The decision was signed October 2, announced in Norway on October 12, and republished by the EDPB on October 16.
Executives
Accountability cannot be outsourced. If your business receives personal data from partners, including through AI tools and data feeds, your regulator will ask what you verified, not what a contract promised. Consent and data lineage evidence are now enforcement-grade records.
CIO / CISO
Inventory every inbound and outbound personal data flow, including email, file sharing, APIs, and AI agents, and attach the legal basis and the evidence for it at each hop. Where a partner collects consent on your behalf, obtain and test the actual consent records; a signal that consent exists is not a demonstration under Article 7.
Engineers
Build the evidence as you go: log data exports with recipient, purpose, and basis; tag special category data at ingestion; and make withdrawal of consent propagate to downstream systems. If you cannot trace a record's path, that is the finding waiting to happen.
Everyone (non-IT)
Companies can be fined for data about you that they never collected directly. When an app asks for consent in vague bundles, that choice can follow your data through a chain of companies you have never heard of, which is why the regulator treated careful consent as the whole ballgame.