Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
Norway's data protection authority fined Xandr, the Microsoft-owned ad tech company, €8.6 million for unlawfully processing personal data, including sensitive categories. The case began with a 2020 complaint from the Norwegian Consumer Council and centered on violations of GDPR's core rules on lawful basis and special-category data.
Why this matters: Xandr runs the kind of infrastructure most people never see. It sits behind online ads, building profiles on what you read, watch, and click. The Norwegian Consumer Council flagged this in 2020. It took until 2026 to reach a final fine. That timeline is the problem as much as the violation. Ad tech companies have spent years processing sensitive personal data at scale, betting that enforcement would be slow and fines would be manageable. An €8.6 million penalty on a Microsoft-owned company is not going to change that math on its own.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.