Norway fines ad-tech firm Xandr EUR 8.6M over invalid consent in ad bidding
Original title：Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
What happened
Norway's data protection authority fined ad-tech company Xandr EUR 8.6 million for processing Grindr users' data in real-time ad bidding without valid consent. The ruling says each joint controller must verify consent itself, which matters to sites that use ad tech partners.
Who is affected
- Sites running ads or real-time bidding
- Firms handling EU users' personal data
- Agencies installing ad and tracking tags
What to do
Check that consent collected by ad partners validly covers your own processing. Review your consent management setup and contracts.
About this policy
- Jurisdiction
- EU · Norwegian Data Protection Authority (Datatilsynet) / EDPB
- Who it applies to
- Firms using ad tech or real-time bidding with user data
DraftConsultationAdoptedIn force
Why this flag
脆弱性ではなく、GDPRに基づく制裁決定の事例紹介であり、期限付きの義務も示されていないためBLUEが妥当です。
Blue flag: be aware — Policy, research, industry trends and guides that need no immediate technical action.
Sources
- Primary source：European Data Protection Board ↗