Lessons from Xandr's EUR 8.6 Million Fine: Consent and Compliance in Direct Marketing

The Norwegian Data Protection Authority (Datatilsynet) has fined Xandr, an advertising technology company, NOK 92 million — approximately EUR 8.6 million — for unlawful processing of personal data in online advertising. The decision is dated 2 October 2026 and was published through the European Data Protection Board on 16 October. The case is a stark reminder that consent under the General Data Protection Regulation (GDPR) has to be valid, and that a company cannot borrow someone else’s.

What happened

Xandr operates on both sides of real-time bidding, the auction system behind much of the advertising people see online. The data at issue came from users of a dating app: the fact that they used it, their advertising identifier and their IP address. Because the app serves a gay, bi, trans and queer community, the authority treated the data as revealing sexual orientation, a special category under Article 9. The complaint was brought by the Norwegian Consumer Council in 2020.

Xandr’s position was that the app had obtained the users’ consent. The authority found that consent invalid under Articles 4(11) and 7, and held that Xandr, as a joint controller for the processing, could not rely on it: in the authority’s words, “accountability cannot be outsourced”. Each joint controller must satisfy itself that the consent it relies on is real. The infringements of Articles 6(1) and 9(1) were found to be at least negligent and of high seriousness.

What valid consent looks like

Under the GDPR, consent must be freely given, specific, informed and unambiguous. Businesses must ensure that individuals are fully aware of what they are consenting to and that they have a genuine choice in the matter. Pre-ticked boxes, vague language, or bundling consent with other terms are not compliant. Where special category data is involved, consent must also be explicit. And the party relying on the consent carries the burden of showing it was obtained — wherever in the advertising chain that party sits.

What this means for businesses

The fine highlights the need to reassess how consent is obtained and managed. It is not enough to simply ask for consent; the process must be transparent and verifiable. Companies should review their consent mechanisms to ensure they meet GDPR requirements, including consent forms, privacy notices, and the processes for collecting and storing consent records. If your advertising depends on data supplied by a partner, the questions are the same ones the Norwegian authority asked: who collected the consent, what exactly did it cover, and can you produce it.

Businesses should also consider regular audits of their data processing activities to ensure ongoing compliance. This proactive approach can help identify potential issues before they result in regulatory action. Engaging with a Data Protection Officer (DPO) can provide valuable insights into maintaining compliance and managing data protection risks effectively.

For support in navigating these complexities, our outsourced Data Protection Officer appointments and Article 37 readiness reviews can offer tailored guidance and assistance.