The App Collected the Data. The Ad Broker Still Owed an Answer.

The auction made the data move faster than the explanation

Real-time bidding is an automated marketplace. When an app has advertising space to fill, information about the user and the available impression can move through supply-side platforms, exchanges, demand-side platforms, and prospective advertisers. Systems compare the opportunity, place bids, and select an ad in a fraction of a second. The machinery is fast because each participant performs a narrow function. Privacy law asks a less mechanical question: who decided why the data would be used, which data were necessary, and whether the person agreed to that use?

According to the Norwegian decision, Xandr operated on both sides of this market. Its supply-side platform helped publishers offer advertising inventory, while its demand-side platform helped buyers bid. The authority found that Xandr processed Grindr usage information together with advertising identifiers and IP addresses and disclosed data to a potentially large number of other companies in the bidding ecosystem.

The sensitivity did not depend on a field labeled sexual orientation. The authority reasoned that information showing a person used Grindr itself revealed information about sexual orientation. That brought Article 9 of the General Data Protection Regulation into the analysis. Article 9 generally prohibits processing data revealing sexual orientation unless a specified exception applies. For the consent exception, the consent must be explicit and must cover the relevant processing.

That matters beyond one app. Sensitive information is often inferential. A location can identify attendance at a clinic, congregation, union hall, or support group. An app category, search pattern, or purchase can reveal more than the literal fields transmitted. A compliance inventory that looks only for obvious labels will miss what the data says when combined with context.

Consent is not a warranty passed downstream

Xandr told the authority that it believed Grindr had obtained consent. The regulator's answer was blunt in substance: another company's assurance did not establish Xandr's lawful basis. Each controller had to determine and demonstrate that a valid legal basis covered its own purpose and processing. Where explicit consent was required, Xandr needed evidence that the consent was valid and extended to what Xandr actually did.

The decision found that Xandr took no meaningful step to verify those points. The consent mechanism attributed to Grindr did not satisfy the GDPR requirements identified by the authority, and Xandr had no independent basis that cured the problem. The authority therefore found violations of both Article 6, which requires a legal basis for processing generally, and Article 9, which adds protection for specified sensitive categories.

This is the part of the ruling with the widest practical reach. Commercial data relationships are full of representations. A supplier promises that collection was lawful. A customer agrees to provide required notices. A platform says its partners are responsible for permissions. Those allocations can matter between the contracting parties, especially for indemnity and audit rights. They do not, by themselves, answer whether the processing was lawful as to the person whose data moved through the system.

The distinction resembles a familiar problem in legal practice. A lawyer may rely reasonably on information supplied by a client or colleague, but reliance does not erase duties that belong to the lawyer. The content, stakes, warning signs, and lawyer's own role determine what must be verified. Data governance works the same way. The farther a company moves from passive transmission and toward selecting purposes, fields, recipients, or uses, the harder it is to describe consent as someone else's file.

Joint control follows decisions, not the organization chart

The authority treated Xandr as a joint controller with other participants for relevant processing. That label does not mean every company in the chain had identical access, motives, or liability. It reflects a finding that Xandr participated in determining purposes and means rather than acting only as a neutral processor carrying out another party's fixed instructions.

The distinction is fact dependent. A vendor does not become a controller merely because it handles data. Nor does a platform escape controller status merely because it never designed the app's sign-up screen. The questions concern actual decisions: which data enter the system, how they are matched, what bidders receive, who may participate, what purposes are permitted, and how long the information remains usable.

That is why an architecture diagram can be a legal document even when it contains no legal language. It shows which entities can make consequential choices. A contract may call one company a processor and another the controller. If the operating system gives the supposed processor independent authority over purposes or essential means, the label may not survive contact with the facts.

The same discipline should shape vendor review. Asking whether a company is GDPR compliant is too abstract. The useful inquiry identifies a specific data flow and asks who controls each consequential decision. Only then can counsel assess the lawful basis, transparency, special-category restrictions, controller arrangements, security, deletion, and the proof each participant must retain.

The acquisition changed ownership, not the historical record

Microsoft acquired Xandr in June 2022, more than two years after the period covered by the violations. Microsoft told Reuters that the incident predated the acquisition, that privacy is a priority, and that it was reviewing its options. The Norwegian authority separately explained that it calculated the fine using Xandr's revenue rather than Microsoft's. That choice kept the penalty tied to the entity whose conduct was under review rather than the later parent's much larger turnover.

The separation is important, but it does not make historical privacy risk disappear in an acquisition. A buyer can inherit an operating company with unresolved complaints, incomplete consent records, retained datasets, continuing vendor relationships, or products whose economics depend on a contested flow of information. The old conduct may have ended while the evidentiary and reputational consequences remain.

Privacy diligence should therefore do more than inventory policies and pending claims. It should test whether the company can reconstruct representative data journeys from collection through disclosure and deletion. It should sample the notices and consent interfaces actually used during relevant periods, not just the current version. It should identify which systems still contain data collected under retired language and whether later processing relies on that historical permission.

Transaction documents can allocate financial risk. Escrows, indemnities, covenants, and disclosure schedules have real value. But remediation is operational. If a buyer cannot determine what data exists, why it was collected, who received it, and what evidence supports continued use, the diligence problem survives closing even if the contract assigns the eventual bill.

Accountability needs evidence at the level of the data flow

The lesson is not that every downstream recipient must rebuild every upstream interface. The required work depends on role, risk, and legal regime. It does mean a company should be able to connect its claimed lawful basis to its own processing with evidence stronger than a partner's general promise.

For a sensitive-data workflow, that evidence begins with a map: the category of data, its source, the purpose of the transfer, the receiving entity, the legal basis, the consent language or other supporting record, the uses permitted downstream, and the retention rule. The map must include inferred sensitivity, not only fields with revealing names. It must also capture changes over time because today's compliant interface cannot retroactively fix yesterday's collection.

Counsel should then look for mismatch. Does the consent name or describe the relevant recipients? Does it separate a necessary service from advertising? Can a person refuse without losing an unrelated function? Does a platform use the data for a purpose broader than the publisher disclosed? Are companies receiving bid requests even when they do not win the auction? A data chain often becomes legally fragile at the point where business practice outruns the explanation given to the person.

Norway's decision can be appealed, and European privacy law does not answer every question for United States companies. The broader governance principle travels well. Responsibility follows decisions and uses, not just the first collection screen. A system designed to move personal information among many parties cannot treat diffusion as a defense. The faster the auction, the more deliberate the proof must be.

A contract can allocate privacy risk between companies. It cannot manufacture lawful consent from the person whose data they use.