pixellint

Norway's Xandr fine says an advertising ID in RTB needs consent your CAPI pipe cannot borrow from the app.

· 13 min read

Check your payload in the playground →

On October 12, 2026, the Norwegian Data Protection Authority announced an NOK 92 million administrative fine against Xandr, now part of Microsoft Advertising, for GDPR violations tied to real-time bidding on the Grindr app. The underlying decision, dated October 2, 2026, is not a consumer-scam roundup. It is a 54-page walk through OpenRTB-style bid requests, advertising identifiers, IP addresses, and the authority's finding that using Grindr at all is special-category data about sexual orientation.

The same week, Digiday tallied early publisher pain from Apple's Safari tracking block: Aditude reported Safari on iPhone and iPad at 11.7% of ad impressions and 11.4% of revenue among its customers, with eCPMs down 10.5% among readers already on the new software while only about 8% of users had upgraded. Browser blocklists and regulator decisions look unrelated until you follow the identifier. Both stories ask who may process an advertising ID, under what legal basis, and whether downstream pipes can assume the publisher already cleared consent.

Server-side conversion APIs are the hop marketers trust when the browser pixel fails. Meta madid, Google app instance ids, and MMP device keys often ride in the same user_data object as hashed email. The Norway decision is a reminder that those fields are not inert join keys. They are personal data that entered the ecosystem through an RTB or SDK path, and a joint controller cannot outsource accountability to Grindr's checkbox.

What the authority actually measured

The Norwegian DPA imposed NOK 92,000,000 for processing without a legal basis under Article 6(1) GDPR and for processing special category data without a valid Article 9 exemption. The conduct covered July 20, 2018 through April 7, 2020, before Microsoft's acquisition, but the reasoning applies to any platform that still treats publisher consent as a blanket license for bidstream enrichment.

The authority found by clear preponderance of probability that Xandr processed at least the fact that individuals were using Grindr, their advertising ID, and IP addresses during real-time bidding. Those elements are personal data under Article 4(1). Combined with the app identity, they are data concerning sexual orientation under Article 9(1). That is not a metaphor about sensitive verticals. The decision treats app-open context as disclosing orientation when the app is Grindr.

Xandr was a joint controller, not a processor hiding behind Grindr's instructions. The DPA held that role for both supply-side and demand-side platform functions: ad requests from Grindr or via MoPub, enrichment with segment and contextual providers, bid requests under OpenRTB 2.4, and sharing with DSPs so they could decide whether to bid. Accountability cannot be outsourced, the decision states; each joint controller must independently verify that consent is valid and covers its own processing.

Grindr's consents were invalid under Articles 4(11) and 7. Xandr did not obtain its own consent and relied on Grindr. That reliance failed. For special category data, explicit consent under Article 9(2)(a) was the relevant basis, and the authority did not accept contract clauses or privacy-policy language as a substitute. The infringements were at least negligent and regarded as highly serious because they concern sensitive data at the center of the regulation.

RTB on the wire versus CAPI in your worker

Real-time bidding, in the DPA's simplified description, fires when a user opens a publisher app and an ad slot triggers an ad request. The request may flow through mediation SDKs, an SSP, segment enrichment, and a bid request broadcast to DSPs. Each hop accumulates and disseminates personal data to target and price the impression. The decision quotes Xandr's 2019 privacy policy language about sharing information so partners can decide whether to bid and build interest profiles.

Mnemonic's technical testing, cited in the decision, confirmed Xandr collected app name, advertising ID, and IP from the Grindr app. Grindr's access-request response stated it shared IP and Google Advertising ID with Xandr when allowed by the user. MoPub documentation claimed truncated IPs for EEA users, yet testing showed full IP addresses transmitted. Those are wire facts, not dashboard opinions.

A Conversions API or MMP server-to-server POST is a different HTTP shape, but it can carry the same identifiers. Meta documents madid for mobile app events. Google and Adjust mappings include device and app instance fields. When your worker copies the advertising ID from the app SDK into user_data because the browser pixel is blocked or because you prefer server-side matching, you are continuing processing that started in the ad stack, not inventing a fresh first-party fact on your origin.

Legal basis is not transferred with the identifier. The DPA rejected Xandr's argument that Grindr's console settings constituted sufficient instructions and that Xandr acted only as processor on the supply path. Joint controllership means your legal team cannot point at the publisher's CMP screenshot while your engineering team still ships madid to Graph for optimization.

Two pipes, one advertising ID

The CAPI body can reintroduce the same personal data the bidstream already spread.

RTB bid request (historical Grindr path):
  app.name = Grindr, device.ifa = <advertising ID>, device.ip = <full IP>

Server conversion POST (same user, later purchase):
  user_data.madid = <same advertising ID>, event_name = Purchase

Norwegian DPA finding:
  joint controller must verify Article 9 consent for its own processing;
  invalid publisher consent does not legalize the DSP or the later reuse

The block above is the production failure in miniature. Operations teams often treat RTB as ad ops and CAPI as marketing analytics. GDPR controllership follows the data, not org charts. If the advertising ID left the app for bidding, copying it into a purchase event is another processing activity that needs its own basis and, for sensitive app contexts, an Article 9 exemption that actually fits.

Microsoft's public statement, quoted by NRK on October 12, 2026, stresses that the investigation concerns conduct before Microsoft bought Xandr and that regulation has evolved since. That is a corporate response, not a safe harbor for new integrations. The decision's logic on joint control, invalid consent, and special category inference from app use is what counsel will cite when the next app in a sensitive category loses a consent fight.

Pixellint is not affiliated with Microsoft, Meta, or the Norwegian DPA. Validating a CAPI JSON checks field shapes and documented enums. It does not prove lawful basis, valid consent, or that madid should have been sent at all.

Accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing.

Norwegian DPA decision executive summary (2026-10-02)

What to verify before the next server-side launch

Inventory which fields in your CAPI or MMP payloads are advertising IDs, app set IDs, or other device keys copied from the mobile SDK rather than minted on your checkout domain. Map each field to the RTB or SDK path where it first appeared. If that path relied on publisher consent you did not independently assess, treat the identifier as toxic until counsel signs a documented basis.

Separate special-category apps from generic retail in your data maps. The Grindr holding is extreme but instructive: app name plus open event can be Article 9 data. Do not send madid from sensitive apps through the same server container template as your shopify SKU catalog without a distinct legal review.

Read the Norwegian decision alongside your OpenRTB and Prebid logs for the same bundle. RTBlint-style bid request review shows what left the supply path; pixellint review shows what your worker POSTs afterward. A gap between no-bid filters and rich CAPI user_data is how regulators reconstruct joint control.

When Apple or a regulator removes a sync path, do not compensate by stuffing more device fields into server events unless consent and purpose limitation actually cover them. Digiday's early Safari numbers show revenue still moving while identifiers break. The answer is not louder CAPI with borrowed IDs. It is narrowing payloads to what you can defend.

Checklist

Sources

Contract pages

The dated argument is above. These pages are the field lists.

Read consent on the collector Docs