Xandr fine: responsibility for consent cannot be outsourced

Xandr on both sides of the auction

The complaint dates from 14 January 2020. The Norwegian Consumer Council, Forbrukerrådet, complained to the authority on behalf of a data subject against Grindr, Xandr and four other adtech companies, relying on its report “Out of Control” and on technical tests commissioned from the security firm mnemonic. The investigation covers the free version of the app and the period from 20 July 2018, when the GDPR entered into force in Norway, to 7 April 2020, the day before a new consent management platform was rolled out in the app for users in Norway.

The mechanism is real-time bidding. When an ad slot is about to be shown, the app sends an ad request to a platform that puts it up for sale. That platform sends potential buyers a bid request describing the slot, the device and the user, and the highest bidder’s ad is shown, all in a fraction of a second. Only one buyer wins the auction, but all of them read the request.

Xandr sat on both sides. As a supply-side platform, it helped Grindr sell its ad slots, receiving requests directly from Grindr. As a demand-side platform, it bid on behalf of advertisers on those same slots, including on requests reaching it through MoPub, then owned by Twitter, whose SDK, a third-party software component embedded in the app, sent Grindr’s ad requests to MoPub’s servers, which relayed them to MoPub’s advertising partners.

Xandr confirmed that it received bid requests about Norwegian Grindr users and processed the data they contained, but says it can no longer identify which data. The authority therefore keeps to what can be established. On a clear preponderance of probability, the standard of proof it applies, it finds that Xandr processed at least three pieces of data: the fact that the person was using Grindr, their advertising ID and their IP address. It notes that Xandr’s list of third-party providers then included more than 4,000 companies, bidders and data providers among them, and that users could not know precisely which of them had received their data.

The app’s name as sensitive data

Taken alone, each of the three looks ordinary. Together, they say that an identifiable person uses Grindr, and for the authority that reveals their sexual orientation. That information therefore falls under Article 9 GDPR, which prohibits processing such data unless an exception applies; the only one left here was explicit consent. The reasoning is not new. It was that of the decision against Grindr, upheld by the Norwegian Privacy Appeals Board, the Oslo District Court and then the Borgarting Court of Appeal. The Xandr decision ties it to the case law of the Court of Justice of the European Union, which, in the decision’s summary, reads special category data broadly to “encompass personal data that are liable to indirectly reveal sensitive information, for example as concerns visits to apps that relate to one of the categories listed in Article 9(1)”, whether or not the information revealed is correct.

The decision concerns only Grindr’s users in Norway and makes no finding on Grindr or MoPub, but its reach for apps is concrete. The three pieces of data match three fields of the standard bidding format, the IAB Tech Lab’s OpenRTB specification: the app’s identifier in its store, which on Google Play is the package name, the device’s IP address and the advertising ID provided by the operating system. The specification says that “at a minimum, it is useful to provide an App ID or bundle, but this is not strictly required.” On the same reasoning, as soon as a bid request names, alongside identifiers like these, an app whose very use reveals an Article 9 category, for example health, religious beliefs, sex life or sexual orientation, it carries that information.

A contract is no substitute for verification

Xandr never collected consent from users itself. It relied on Grindr, which its contracts obliged to obtain valid consent where required. Grindr’s consents were not valid: in 2021 the authority had found that those collected through its previous consent management platform were not freely given, specific, informed or unambiguous, and were not as easy to withdraw as to give.

The decision rejects that defence. Joint controllers must each have a legal basis for their processing. It is possible, and sometimes necessary, to agree that one collects consent on behalf of the other, but only if both make sure that the consent meets every requirement of Articles 4(11) and 7 GDPR, is properly documented and covers each party’s processing. In the authority’s words, “Compliance can never be outsourced.” Joint control does not mean equal responsibility, it points out, and Grindr was the one collecting consent; but Xandr had taken no measure to verify that the consents were valid or what they covered, and the authority adds that as a company “further down the chain”, with no direct contact with the people concerned, “it had all the more reason to check and ensure lawfulness.” Guidance already published at the time by the Article 29 Working Party on consent would, it says, have helped Xandr see that Grindr’s mechanism did not comply with the GDPR.

Xandr also argued that its master services agreement prohibited Grindr from sharing special category data with it. Such a clause, the authority replies, does not relieve Xandr of its responsibility when it in fact processed Article 9 data, and, citing the Court of Justice, it adds that it does not matter whether a controller is seeking to obtain that kind of information. The clause even shows, in its view, that Xandr instructed Grindr on the categories of data to share with it.

The CNIL, France’s data protection authority, sets the same requirement at the other end of the chain. Its recommendation on mobile apps asks publishers to ensure, for the processing they are responsible for, that people’s rights, consent included, are respected “even when their practical implementation depends on a third party”. The Norwegian decision applies it to the third party that depends on the publisher. Line Coll, the authority’s Director General, sums it up in the press release: “Our key message is that responsibility for data protection cannot be passed on to others. Each and every company must itself ensure, and be able to document, that they process personal data lawfully.” And: “When companies do not take responsibility and blame each other, the rights of users become, in practice, worthless.”

On the selling side, nobody claimed to be the controller

Xandr accepted that it was a joint controller when it bid on behalf of advertisers, and a controller for a few purposes of its own, such as frequency capping, security, fraud detection and improving its platform. For the rest of the sale of Grindr’s ad slots, it argued that it acted only as a processor: Grindr and MoPub had access to a console where they could choose the categories of data sent in bid requests and the buyers allowed to receive them, and those settings were their instructions. Grindr, for its part, denied any controller-processor relationship with Xandr. So neither of them accepted controllership for this processing, the authority observes, and a person wishing to exercise their rights would have found no one to turn to on either side. In its words, “a formal agreement therefore cannot solve a situation where no entity accepts controllership in practice.”

The authority relies in particular on the default settings. Xandr provided the framework for those choices, including which buyers Grindr could deal with and exclude. Where Grindr changed nothing, bid requests circulated according to the standards Xandr had selected, to the partners it had brought onto its platform. That framework, the decision finds, gave it a tangible influence on the purposes and means of processing it also carried out for its own ends, by enriching requests and, though Xandr disputes this, by improving its platform. Under the Court of Justice’s IAB Europe ruling, which the decision cites, that makes Xandr a joint controller on the selling side too; on the buying side, Xandr had already accepted it.

The CNIL’s recommendation turns default settings into a requirement for SDK providers, for the processing they are responsible for, from the design of their service: offering default configurations that comply with data minimisation, down to the configuration examples in their documentation, and avoiding the collection or retention of device or network identifiers that can be linked to individuals, IP addresses included, when the use of the SDK does not require it.

What the documentation said, what the tests showed

The decision notes in passing, following the Consumer Council’s report and making no finding on MoPub, whose activities it did not assess, that MoPub’s SDK documentation described the SDK as truncating the IP addresses of users in the EU and the EEA, to pseudonymise them and comply with the GDPR. “However, the technical testing showed that the MoPub SDK was transmitting the full IP address to Xandr.”

Those same tests, run by mnemonic from 8 July to 31 December 2019 on the data leaving the app, confirm that Xandr received, from the Grindr app and through MoPub, the app name, the advertising ID and the users’ IP addresses; Xandr acknowledged this at a meeting with the authority in February 2025. More than six years on, the decision still relies on them, alongside Xandr’s own statements and documents, to say what the app was sending. Xandr, for its part, could not produce some of the documentation requested, which it says was deleted under its retention policies between July 2020 and February 2023, although it had known since 21 February 2020 that the authority was investigating. The authority refuses to let that deletion count in its favour: the burden of demonstrating compliance rests on the controller, and accepting the argument “would in practice incentivise undertakings to erase documentation in order to circumvent supervision by data protection authorities.”

An SDK’s documentation describes what its provider intends to do, a contract what the parties promise each other; only observing what leaves the phone shows what the app sends, to whom, and when. The CNIL’s recommendation in fact provides for it on the publisher’s side, as good practice: setting up, or having a third-party provider set up, a testbed that intercepts the network traffic of a test phone or emulator, to check that its consent collection tools work. That observation still has to be dated and kept by whoever will have to answer for it.

A fine calculated on Xandr alone

The authority regards the infringements as highly serious: they concern some of the most central provisions of the GDPR, sensitive data included, lasted almost two years and sit at the core of Xandr’s business. It also counts as aggravating the financial benefit Xandr drew from them, and takes two mitigating factors into account: the length of the case handling and Xandr’s voluntary attendance at a meeting held to establish the facts, which it regards as only slightly mitigating. The amount is calculated on Xandr’s own turnover, not Microsoft’s, since Microsoft did not own Xandr at the time; as 4% of that turnover was below 20 million euros, the latter set the legal ceiling.

The decision was not final when published. Xandr had three weeks from receiving it to appeal; if the authority upheld its decision, the appeal would go to the Privacy Appeals Board.

What the decision changes for an app and its partners

In 2021, the publisher answered for the consent it collected; in 2026, its partner answers for it too, for its own processing, and cannot hide behind a contract. In an advertising chain, the consent collected by the app is the legal basis of everyone who relies on it, and each must be able to show that it has checked that consent, to the extent of its role.

In our view, that check starts in the app. What an adtech company receives on its servers shows what was passed to it, by the app or by an intermediary that may have enriched it; it shows neither how the choice was obtained nor what the app sent to others before that choice. It is the other side of a point we made about monetisation: consent that does not reach the buyer is monetised like a refusal. The Xandr decision shows that invalid consent also exposes those who receive it.

In practice, an app that sells its ad slots can ask itself a few questions. Which third-party actors does it contact directly, before any choice and after a refusal, given that each of them receives at least the public IP address the device connects from? Which identifiers does it send them? Does the user’s choice reach them? Does its very use reveal a category of sensitive data, in which case, on the Norwegian authority’s reasoning, the package name it sends alongside an advertising ID or the IP address becomes sensitive data itself? And have the default settings of its advertising SDKs been reviewed, or simply accepted?

These questions are checked against what the app sends, and they apply as much to the publisher as to the ad network or adtech company that relies on its consent. Skanopy automatically drives the Android app on a real phone and records, before and after the user’s choice, the third-party actors the app contacts, what it sends them and which of them receive that choice, and dates every finding, version after version. That is the whole point of a mobile app analysis: it does not state the law, it supplies the dated evidence the law is applied to.

Sources

Every finding in this article points to one of these documents. Quotations from the CNIL are taken from its English courtesy translation.

1. Datatilsynet ’26Microsoft company fined NOK 92 millionDatatilsynet, 12 October 2026
2. Datatilsynet ’26Administrative fine - Unlawful processing of personal dataDatatilsynet, decision of 2 October 2026, ref. 20/03541-37, public version
3. EDPB ’26Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal dataEuropean Data Protection Board, 16 October 2026
4. Datatilsynet ’25The Court of Appeal upholds the fine against GrindrDatatilsynet, 21 October 2025
5. Datatilsynet ’25Gebyret mot Grindr blir ståendeDatatilsynet, 21 October 2025, updated 26 November 2025 (in Norwegian)
6. Forbrukerrådet ’20Out of Control: How consumers are exploited by the online advertising industryForbrukerrådet, 14 January 2020
7. CNIL ’25Recommendation on mobile applicationsCNIL, courtesy translation of deliberation no. 2025-024 of 27 March 2025 (amended version published on 8 April 2025)
8. OpenRTB 2.6OpenRTB 2.6, sections “Object: App” and “Object: Device”IAB Tech Lab
9. GDPRRegulation (EU) 2016/679, Articles 6, 9 and 26Official Journal of the European Union