DPA case 20/03541-37 – €8,004,000 Fine (Norway, 2026)

The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where the clients were able to conduct, optimize and track their advertising transactions. Through the platform, Xandr receives ad requests of their clients and enriches the bid with information which segment(s) a user belongs to. The bid request is sent to advertisers who evaluate the request and decide whether to bid on the ad space. Real-time bidding requires the collection, accumulation and dissemination of personal data to target and personalise the advertisement and optimise the bid. The console offers settings where the clients of Xandr can exclude certain categories of data from bid requests or to exclude certain recipients from receiving bid requests. Within this process of real-time bidding at hand, Xandr processed personal data of Grindr users in Norway. Grindr is a dating app with a target market in the LGBTQ+ community. Amongst the data processed by Xandr was the information that individuals were using Grindr, their advertising ID, and IP addresses. This data was shared with third-party advertisers. On the one side, Xandr provided assistance to Grindr to make its ad spaces available to potential buyers. On the other side, Xandr also operated on the demand side and send ad requests to third parties where an ad should be placed on the Grindr app, through an intermediary that had access controls within the console. The Norwegian Consu