The Challenge
In 2020, the Norwegian Consumer Council filed a complaint against Xandr (then AppNexus, now part of Microsoft) over its handling of personal data during real-time bidding on Grindr, a dating app for LGBTQ+ users. This complaint led to a lengthy investigation revealing a major misunderstanding about joint controller responsibilities under the GDPR.
Xandr functioned as both a supply-side and demand-side platform in the real-time bidding ecosystem. During bid requests, it processed users' advertising IDs, IP addresses, and the fact that individuals were using Grindr. The Norwegian DPA determined this last data point was special category data under Article 9(1) GDPR, data concerning sexual orientation.
The core issue: Xandr did not obtain its own consent from users. It relied entirely on Grindr's consent mechanism. This reliance proved disastrous when the DPA ruled Grindr's consent invalid under Articles 4(11) and 7 GDPR.
The Environment and Constraints
Real-time bidding creates a complex joint controller environment. Multiple parties handle the same personal data within milliseconds, each performing distinct processing operations. Xandr faced several constraints:
Technical architecture: Bid requests pass through multiple intermediaries. By the time Xandr received a bid request, the user had already interacted with Grindr's Consent Management Platform, not Xandr's. The data arrived pre-packaged.
Special category data requirements: Article 9(2)(a) GDPR requires explicit consent for processing data revealing sexual orientation. This requires stricter documentation and a higher threshold than Article 6(1)(a)'s valid consent.
Joint controller status: The DPA classified Xandr as a joint controller with Grindr, not a processor or independent controller. This status carries specific obligations under Article 26 GDPR, including transparent allocation of responsibilities and independent verification of the Legal Basis for Processing.
Commercial pressure: Real-time bidding relies on speed. Adding independent consent verification at each node could slow the auction, potentially reducing bid participation and revenue. Xandr faced a compliance-versus-velocity tradeoff.
The Approach Taken
Xandr's approach was simple but legally insufficient: trust the upstream consent.
The company treated Grindr's consent as a pass-through credential. If Grindr claimed it had consent, Xandr processed the data without independent verification or separate consent collection. There was no technical mechanism to ensure that Grindr's consent covered Xandr's specific processing activities.
This approach was based on three assumptions:
- Joint controllers can delegate consent verification to the party with direct user contact.
- Consent obtained by one controller automatically extends to all controllers in the chain.
- Accountability under Article 5(2) GDPR can be satisfied by contractual arrangements rather than independent technical controls.
The Norwegian DPA rejected all three assumptions.
Results and Metrics
The Norwegian DPA fined Xandr Inc. EUR 8,600,000.
The decision established several binding findings:
Legal basis failure: Xandr violated Article 6(1) GDPR by processing personal data without a valid Legal Basis for Processing. Relying on another controller's invalid consent compounded the issue.
Special category violation: The company violated Article 9(1) GDPR by processing data concerning sexual orientation without a valid exemption. The DPA found this violation "at least negligent," indicating Xandr should have recognized the sensitivity of Grindr usage data.
Accountability cannot be outsourced: The DPA's key finding: "Each joint controller must independently verify that consent is valid and covers its own processing." This duty can't be delegated through contracts or technical architecture.
High seriousness classification: Because the violations involved "some of the most central provisions in the GDPR, including sensitive data," the DPA classified the infringements as highly serious, influencing the penalty.
What They Would Do Differently
Based on the DPA's reasoning, Xandr would need to restructure its consent verification:
Independent consent verification: Implement technical controls to validate consent signals before processing bid requests. This could involve querying a consent string, checking a cryptographic proof, or maintaining a separate consent record controlled by Xandr.
Explicit consent for special categories: When processing involves potential Article 9(1) data, don't rely on general consent. Obtain explicit, documented consent specifically addressing sexual orientation data or similar special categories.
Purpose-specific consent mapping: Verify that upstream consent covers Xandr's processing purposes. If Grindr's consent notice says "we share data with advertising partners," it may not sufficiently inform users about real-time bidding mechanics.
Joint controller agreements with teeth: Article 26 GDPR requires joint controllers to transparently allocate responsibilities. Agreements must include verification mechanisms, not just liability allocation. If the agreement says Grindr handles consent, Xandr still needs technical proof that consent is valid.
Conservative special category classification: When uncertain about whether data reveals special categories, treat it as if it does. The fact someone uses Grindr reveals sexual orientation even if you never see profile content.
Takeaways for Your Team
If you're operating in a joint controller environment, especially in advertising technology, analytics platforms, or data partnerships, this case updates your compliance checklist:
Don't trust, verify: Contractual assurances from upstream controllers aren't enough. You need technical verification that consent exists, is valid under Articles 4(11) and 7, and covers your specific processing.
Special category data is everywhere: Location data from a mosque, health app usage, dating app presence, these all potentially reveal Article 9(1) categories. Your data classification process must account for inferred special categories, not just explicit declarations.
Consent strings need independent validation: If you're relying on TCF v2.3 or similar frameworks, you're still responsible for validating the consent string. Check the timestamp, verify the purposes match your processing, confirm the legal basis is actually consent (not legitimate interest).
Article 26 agreements must be operational: Your joint controller agreements need more than liability clauses. Include technical specifications for consent verification, audit rights, and breach notification procedures.
Negligence is enough: The DPA found Xandr "at least negligent", you don't need intent to violate GDPR to face maximum penalties. Reasonable care requires independent verification systems, not just good-faith reliance on partners.
The Norwegian DPA's message is clear: in joint controller arrangements involving special category data, each party must independently demonstrate valid consent. Your partner's compliance failures become your regulatory liability, and "we trusted them" isn't a defense that meets Article 5(2) accountability requirements.
