What the regulator decided
According to the European Data Protection Board’s report published on 16 October 2026, Norway’s data protection authority fined Xandr €8.6 million. The regulator concluded that Xandr processed Grindr users’ advertising IDs, IP addresses and information indicating use of Grindr in real-time bidding without an adequate legal basis. The case concerned special-category personal data and Xandr’s role as a joint controller. The final decision was dated 2 October 2026.
The consent problem was not simply a missing banner
Xandr relied on consent collected by Grindr. The authority found that the upstream consent was invalid and concluded that accountability could not be outsourced: a joint controller must verify that consent is valid and covers its own processing. This is a specific regulatory finding involving particularly sensitive data. It should not be generalized into a claim that every advertising integration requires the same configuration or that every publisher is a joint controller.
Where technical verification can help
A practical browser-level review can record which selections a visitor was offered, how a CMP recorded observable state, whether Google Consent Mode or TCF signals changed, which tags ran, and which requests left the browser. Comparing this evidence helps identify implementation mismatches, missing updates or signals that appear inconsistent with an intended configuration.
What technical testing cannot prove
A browser investigation does not usually reveal every downstream data recipient, their internal processing purpose, or the validity of a legal basis for every party in a real-time bidding ecosystem. The Xandr case demonstrates why technical checks complement, rather than replace, appropriate controller-level legal and governance assessments.
A narrow, useful deliverable
Rather than report that a site is “GDPR compliant,” document what happened under each tested choice and environment: banner state, recorded signals, relevant requests, and unresolved questions. Hand off controller responsibility, vendor contracts and legal-basis questions for qualified legal or privacy review. The EDPB case summary is the source for the decision.
TECHNICAL IMPLEMENTATION SUPPORT
Want evidence of what your site sends after a consent choice?
We can document technical consent and tracking behavior in the browser and flag unanswered questions without claiming to certify downstream legal compliance.
Request Technical AssistanceTechnical investigation only, not legal advice or compliance certification.