The Norwegian Data Protection Authority issued a final decision on 2 October 2026, imposing an administrative fine of EUR 8,600,000 on Xandr Inc. for unlawful processing of personal data. The authority found that Xandr processed personal data without a legal basis, violating Article 6(1) of the GDPR, and failed to obtain valid consent for processing special category data concerning sexual orientation, violating Article 9(1) of the GDPR.
The decision relies on Article 6 regarding the lawfulness of processing and Article 9 concerning the processing of special categories of personal data. The Norwegian DPA determined that Xandr acted as a joint controller in the processing of Grindr users' personal data.
The fine applies specifically to Xandr Inc., which is identified as the controller in this case. The processing involved personal data related to users of the Grindr app, including their advertising ID and IP addresses.
The Norwegian DPA's decision highlights the necessity for joint controllers to independently verify consent validity. The infringements were deemed serious, particularly due to the nature of the sensitive data involved.