As reported by The Hacker News, the Norwegian Data Protection Authority has levied its largest-ever administrative fine — €8.6 million — against Xandr, now a Microsoft subsidiary, for systematically relaying Grindr users' sensitive personal data, including sexual orientation, to potentially thousands of advertising entities via real-time bidding (RTB) between 2018 and 2020. This case is less about a single company's misstep and more about the structural unsustainability of RTB under GDPR's consent requirements.
Why the Joint Controller Finding Matters
The DPA's determination that Xandr was a joint controller alongside Grindr is the legal cornerstone of this enforcement action — and it has industry-wide implications. Xandr attempted to defer responsibility, claiming it assumed Grindr had obtained the necessary consent. The DPA rejected that deflection outright, establishing that any entity exercising meaningful control over how personal data is processed bears independent obligation to ensure a lawful basis exists.
This is not novel law. GDPR Article 26 has always contemplated shared responsibility among controllers who jointly determine purposes and means of processing. But the ad tech ecosystem has long operated on an implicit assumption that downstream intermediaries could rely on upstream consent. The Norwegian DPA is signaling that assumption is legally indefensible — and other DPAs across Europe are likely to follow.
The RTB Problem Is Structural
The real-time bidding model inherently requires broadcasting user data to thousands of potential buyers simultaneously. Under GDPR, that constitutes processing of personal data — and when the data reveals sexual orientation, it triggers Article 9's heightened protections requiring explicit, informed consent.
The technical reality of RTB makes true compliance nearly impossible. Each bid request can expose device identifiers, location, app context, and behavioral signals to dozens or hundreds of demand-side platforms simultaneously. There is no mechanism for granular, per-recipient consent at the speed and scale RTB demands. This isn't a configuration error — it's an architectural incompatibility with GDPR's consent framework.
The IAB's Transparency and Consent Framework (TCF), which the industry adopted as a compliance shield, has already been criticized by the Belgian DPA in its 2022 decision against IAB Europe. The Norwegian action reinforces that trajectory: self-regulatory consent banners and framework participation do not substitute for legally valid consent under Articles 6 and 9.
Microsoft Inherits the Liability
Microsoft acquired Xandr in December 2021 and retired the brand in June 2023, consolidating it under Microsoft Advertising. The infringements predate the acquisition, but the liability follows the corporate entity. This should prompt every acquirer to scrutinize target companies' data processing practices during due diligence — particularly in ad tech, where historical non-compliance can surface years later as material financial risk.
For Microsoft specifically, this creates reputational complexity. The company has invested heavily in positioning itself as privacy-forward, particularly in enterprise and government markets. A €8.6 million fine for facilitating disclosure of sexual orientation data cuts against that narrative.
Shield53 Recommendations
The Norwegian DPA has set a ceiling with this fine. Other European regulators now have a precedent for similar enforcement. Companies operating in RTB — whether as buyers, sellers, or intermediaries — should treat this as a wake-up call that the structural privacy problems of programmatic advertising are no longer tolerable under GDPR.
