The Challenge
Between July 2018 and April 2020, Xandr managed real-time advertising auctions within Grindr, exposing Norwegian users' sensitive data, including sexual orientation, to thousands of companies. Advertisers received profiling information from Xandr and bid to display ads to specific Grindr users. However, the consent chain was flawed.
Xandr operated as a joint controller with Grindr under GDPR Article 26, sharing responsibility for lawful processing. Xandr assumed Grindr had obtained valid user consent but failed to verify this. Norway's Datatilsynet found no valid consent for the processing, leading to unauthorized data sharing.
The authority issued a NOK 92 million ($9.6M) fine, its largest ever.
The Compliance Trap
Joint controller arrangements pose specific compliance challenges. Under Article 26, each controller must jointly determine processing purposes and means. You can't rely on the other party to verify consent, even if they have direct contact with data subjects.
Xandr faced three key constraints:
No direct user relationship. Grindr collected data and managed user interfaces, while Xandr operated the auction infrastructure.
Real-time auction mechanics. The system required sharing user profiles with thousands of advertisers in milliseconds, complicating post-collection consent verification.
Special category data. Article 9(1) prohibits processing data revealing sexual orientation unless an Article 9(2) exception applies. Informed Consent under Article 9(2)(a) requires users to understand what sensitive data is processed and why.
These constraints didn't absolve Xandr of verifying consent. They required stronger controls, not assumptions.
The Approach Taken
Xandr relied on contractual assurances from Grindr without implementing technical or organizational measures to confirm explicit user consent for auction-based profiling. It didn't audit Grindr's consent mechanisms or require proof that users understood their data would be shared in real-time bidding.
Datatilsynet Director General Line Coll stated, "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing."
This approach treated joint controller status as a formality, not a shared compliance obligation, leading to the processing of special category data without confirming legal requirements.
Consequences
Datatilsynet's NOK 92 million ($9.6M) fine highlighted the severity: "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."
This decision impacts more than Xandr's finances. Noyb, the privacy advocacy group that filed the complaint, called it "a major blow to the online adtech industry." The ruling clarifies that downstream processors can't rely on upstream consent claims without verification, even if the upstream party controls the user interface.
Microsoft, which acquired Xandr after the violation period, noted that "the investigation and the outcome focused on conduct that predates Microsoft's acquisition." The company is reviewing the decision and considering an appeal.
What Should Have Been Done
A functioning joint controller consent verification system requires technical controls, not just contractual language. Here's what that entails:
Consent pass-through architecture. Develop APIs to transmit cryptographically signed consent records from the data collector to downstream processors. Each processor should verify the signature, timestamp, and scope before processing.
Automated consent checks. Don't start an auction until your system confirms valid consent for the specific processing purpose. If the consent record is missing, expired, or doesn't cover real-time bidding, halt the auction.
Regular consent audits. Quarterly, sample user records and verify the consent chain end-to-end. Ensure users saw clear language about third-party sharing, consent wasn't bundled with terms of service, and withdrawal mechanisms work.
Article 26 arrangements that assign verification duties. Your joint controller agreement should specify who verifies consent, how often, using what technical method, and what happens when verification fails. "The other party will handle it" isn't compliant.
For special category data under Article 9, add a second verification layer: confirm users understood the sensitive nature of their consent. Generic "we share data with partners" language doesn't meet the Informed Consent standard.
Takeaways for Your Team
If you're processing data as a joint controller, these controls are essential:
Map your joint controller relationships. Identify every scenario where you and another organization jointly determine processing purposes or means. Include ad networks, analytics providers, and CRM integrations.
Document verification responsibilities in Article 26 arrangements. Your agreement must specify how each party will verify lawful basis. If relying on the other controller's consent collection, define how you'll confirm its validity before processing.
Build consent verification into data flows. Don't accept data from a joint controller without a machine-readable consent record. Your systems should check consent status before processing.
Treat special category data as a separate compliance track. Sexual orientation, health data, biometric data, and other Article 9 categories require Informed Consent. Verify users saw clear language about the sensitive nature of the processing.
Run joint controller audits. Quarterly, sample records from your joint processing activities and verify the consent chain. Check timestamps, withdrawal dates, and scope. If gaps are found, stop processing those records until the legal basis is fixed.
The Xandr case shows that assuming a partner handled consent isn't a defense. Joint controller status means joint liability. Your verification controls must match the sensitivity of the data you're processing.
