The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent. Xandr was found to be a joint controller in real‑time bidding, relying on invalid consent from Grindr for sexual orientation data.
Why it matters: The fine highlights the strict liability of joint controllers for obtaining valid consent when handling sensitive personal data.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
