When the Norwegian Data Protection Authority fined Xandr NOK 92 million for unlawfully sharing sensitive data from Grindr users, the company's defense was predictable: they assumed someone else had obtained consent. The regulator's response was clear: responsibility for data protection cannot be passed on to others.
This message should be displayed prominently in every marketing technology office. The mistake Xandr made, assuming an upstream partner handled compliance, is common in programmatic advertising, and it's costing companies millions.
Why These Mistakes Keep Happening
The ad tech ecosystem relies heavily on delegation. A publisher integrates a Consent Management Platform. The CMP passes a consent signal to a supply-side platform, which relays bid requests to a demand-side platform. The DSP then routes data to data management platforms, measurement vendors, and creative optimization services. At each step, someone assumes the previous party obtained valid consent.
This assumption seems reasonable because independently verifying consent at every node appears operationally impossible. However, GDPR Article 5(2) requires each controller to demonstrate lawfulness. "We trusted our partner" is not a legal basis for processing.
The Norwegian DPA emphasized that companies cannot simply blame one another. Each company must ensure and document that they process personal data lawfully.
Mistake 1: Treating Consent Signals as Proof of Consent
Why it happens: Your demand-side platform receives a TCF v2.3 string indicating user consent for certain purposes. The string is cryptographically signed and looks legitimate, so you process the bid request.
The consequence: The string might be valid in format but invalid in substance. The Consent Notice might have used a Cookie Wall, or the publisher might have pre-ticked boxes. You're still processing special category data without a lawful basis.
The fix: Implement spot-checks of the consent collection interface for your top 100 supply sources. Your legal team should review actual Consent Notices quarterly. If a publisher's banner violates EDPB Guidelines on Clear Affirmative Action or Equal Prominence, flag the inventory source and demand remediation or suspend the relationship.
Document your verification process. When a regulator asks how you ensured lawful processing, "we received a TC string" won't satisfy Article 5(2). "We audited the consent interfaces of our top supply partners and suspended three for non-compliance" might.
Mistake 2: Relying on Contractual Warranties Instead of Technical Controls
Why it happens: Your data processing agreement with upstream partners includes a warranty that they've obtained all necessary consents. Your legal team negotiated indemnification, so you think you're covered.
The consequence: Contractual protections don't prevent regulatory fines. The Norwegian DPA fined Xandr directly. Each controller is independently liable.
Indemnification might help recover costs after the fact, but it doesn't stop enforcement actions, reputational damage, or operational disruption.
The fix: Build technical verification into your data ingestion pipeline. Before processing a bid request containing special category data, check for:
- Presence of a consent signal (TC string, GPP string, or equivalent)
- Timestamp indicating consent was collected within the last 13 months
- Consent scope matching your intended processing purpose
- Publisher domain on your approved-supply list
If any check fails, drop the request. You'll lose some bid opportunities, but you won't lose NOK 92 million.
Mistake 3: Assuming "Sensitive Data" Only Means What You Explicitly Collect
Why it happens: Your platform doesn't ask users about sexual orientation, health status, or political views, so you think Article 9 doesn't apply to you.
The consequence: Xandr didn't collect sexual orientation directly. They processed bid requests from Grindr, a dating app whose user base reveals sexual orientation by implication. The regulator considered this special category data.
If you process advertising requests from health apps, fertility trackers, political campaign sites, or religious content platforms, you're handling special category data whether you label it that way or not.
The fix: Classify inventory sources by implied sensitivity, not just explicit data fields. Maintain a list of domains and app IDs that reveal special categories by context:
- Health and medical apps
- Dating apps serving specific communities
- Political campaign properties
- Religious or philosophical content sites
- Financial hardship or debt management services
Apply heightened consent verification to these sources. Consider whether Legitimate Interest is defensible (it usually isn't for special categories). When in doubt, require explicit consent with granularity at the purpose level.
Mistake 4: Treating Consent as a Binary Signal
Why it happens: Your system checks whether gdprApplies=1 and consentString exists. If both are true, you process. If either is false, you don't.
The consequence: Valid consent under GDPR requires unambiguous consent, prior consent, granularity, and the ability to withdraw consent as easily as it was given. A consent string tells you nothing about whether the collection interface met these standards.
The Norwegian DPA noted that thousands of users were subjected to unlawful sharing. Not zero users who declined consent, thousands who ostensibly consented through an interface that didn't meet regulatory standards.
The fix: Expand your consent evaluation beyond signal presence:
- Verify the consent was collected before Terminal Equipment Access
- Check that the publisher offers genuine choice (no Cookie Wall)
- Confirm users can withdraw consent through the same interface
- Validate that purpose descriptions match your actual processing
Implement a consent quality score for supply partners. Weight bid requests from high-quality sources. Gradually reduce spend with partners who can't demonstrate compliant collection.
Mistake 5: Believing Scale Provides Cover
Why it happens: You process millions of bid requests per second across thousands of publishers. Regulators can't possibly audit all of them. You'll fix problems if you get a complaint.
The consequence: The Norwegian DPA targeted Xandr because they acted as an intermediary that relayed data to potentially thousands of other companies. Scale amplified the violation; it didn't dilute enforcement risk.
Regulators increasingly use scale as an aggravating factor in fines. The more users affected, the higher the penalty. The CNIL has issued fines specifically for widespread cookie consent violations.
The fix: Implement compliance monitoring that scales with your data volume:
- Sample 0.1% of bid requests daily for consent signal validation
- Flag anomalies (sudden drops in consent rates, new supply sources, missing TC strings)
- Audit your top 20% of supply partners (by volume) quarterly
- Maintain runbooks for suspending non-compliant inventory within 24 hours
Document everything. When a regulator asks what you did to ensure compliance at scale, you need evidence of systematic controls, not assurances that you would have acted if you'd known.
Prevention Checklist
- Audit consent collection interfaces for your top 100 supply sources quarterly
- Implement technical checks that drop bid requests lacking valid consent signals
- Classify inventory sources by implied data sensitivity, not just explicit fields
- Verify consent was collected before any Terminal Equipment Access occurred
- Maintain an approved-supply list and suspend sources that fail compliance reviews
- Document your consent verification process in writing
- Review Data Processing Agreements to confirm each party's independent compliance obligations
- Sample bid requests daily for consent signal anomalies
- Train your bid operations team to recognize special category data by context
- Establish a 24-hour suspension protocol for non-compliant inventory sources
The Norwegian DPA's message is clear: when companies don't take responsibility and blame each other, the rights of users become worthless. Your contracts won't save you. Your scale won't hide you. Your assumptions about upstream consent will cost you millions.
Each company must ensure lawful processing. Start with these fixes. Document your efforts. And stop assuming someone else handled compliance.
