Datatilsynet (Norway) · 2 October 2026
Not named in the source
About: Accountability, Consent, Data principles, Special categories, Unlawful processing
FineNOK92,000,000≈ €8,490,000
- Regulator
- Datatilsynet (Norway)
- Decided
- 2 October 2026
- Country
Norway- Sector
- Not given
- Regulator’s reference
- 20/03541-37
- Fino case number
- 2026/NO/007
What happened
The DPA fined Xandr NOK 92 m (€8.5 m) because it processed (sensitive) personal data of Grindr users without valid consent when it engaged in real-time bidding. Xandr acted as a joint controller because in real-time bidding, multiple parties participate in the decision making.
Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 4Definitions4(11)Read →
- Art. 5Principles relating to processing of personal data5(2)Read →
- Art. 6Lawfulness of processing6(1)(a)Read →
- Art. 7Conditions for consentRead →
- Art. 9Processing of special categories of personal data9(1) · 9(2)Read →
- Art. 24Responsibility of the controllerRead →
- Art. 26Joint controllers26(1)Read →
- Art. 83General conditions for imposing administrative fines83(5)(a)Read →
- Accountability
- Consent
- Data principles
- Special categories
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Thank you for telling me: write to hello@finoprivacy.com and quote 2026/NO/007.