GDPR Joint Controllers Cannot Outsource Consent

Consent you did not collect is a liability you still own. That is the practical message of the EUR 8.6 million fine Norway’s data protection authority just imposed on Xandr, the advertising technology company now part of Microsoft, and it should change how every data protection officer reads the phrase “our partner handles consent.”

The facts are specific. Norway’s Datatilsynet signed its final decision on October 2, 2026, announced the fine in Norway on October 12, and the European Data Protection Board republished the decision on its national news page on October 16. The case began with a 2020 complaint from the Norwegian Consumer Council about real-time bidding that involved users of Grindr, a dating app for gay, bi, trans, and queer people. Xandr never asked those users for consent. It relied on the consent Grindr said it had collected, and the authority found that consent invalid.

Advertising technology is the setting, but the principle travels. Any organization that receives personal data from a partner, passes it to a partner, or shares it by email, file sharing, APIs, or AI agents sits in the same position as Xandr the moment a regulator asks who verified what. This post walks through what the authority decided, why the reasoning matters to a CISO or compliance officer, and where a governed exchange such as Kiteworks secure data exchange can help you enforce and evidence your own decisions, and where it cannot.

Key Takeaways

1. Upstream consent is not a defense.

The authority held that each joint controller must verify that consent is valid and covers its own processing, so a partner’s assurance does not transfer accountability.

2. A contract clause does not undo joint controllership.

Xandr prohibited partners from sharing special category data, yet the authority still found it jointly determined which categories of data were shared.

3. Using an app can reveal special category data.

The authority treated the fact that a person used Grindr, together with an advertising ID and IP address, as data concerning sexual orientation under Article 9(1).

4. Negligence needs no bad intent.

The authority found the infringements at least negligent and of high seriousness because they touched central GDPR provisions and sensitive data.

5. Evidence is the defense.

Compliance leaders who can show what data left, to whom, under which rule, and who approved it are in a far stronger position than those holding contractual assurances alone.

What the Norwegian DPA Decided

The authority fined Xandr Inc. NOK 92,000,000, which the EDPB lists as EUR 8,600,000, for processing Grindr users’ data without a legal basis under Article 6(1) of the GDPR and in breach of Article 9(1), because no valid exemption applied. The data in question was the fact that a person used Grindr, their advertising ID, and their IP address. According to the redacted public version of the decision posted by the Norwegian Consumer Council, the authority also treated app identifiers as part of that data set.

Two parts of the reasoning deserve a slow read. First, the authority treated the bare fact of using Grindr as revealing sexual orientation. Nobody had to disclose their orientation in a field on a form. The inference from context was enough to bring the data under the special category prohibition. Second, the authority concluded that the relevant exemption was explicit consent, and that no valid explicit consent existed for Xandr’s processing.

The authority characterized the infringements as at least negligent and of high seriousness. Neither label requires proof that anyone set out to break the law. Negligence in this context means that an organization failed to take the care a controller in its position should have taken. That standard is much easier for a regulator to meet than intent, and it is the standard your own file will be measured against.

One point on dates will save you confusion when colleagues quote the story. The decision is dated October 2, 2026. Press coverage in Norway and Europe carried it from October 12. The EDPB page that many readers will find first carries a publication date of October 16. All three dates refer to the same decision.

Why Reliance on Grindr’s Consent Failed

Xandr did not collect consent from users itself. It relied on consent that Grindr collected through its previous consent management platform, according to the decision text. The authority held that those consents did not meet the GDPR standard for consent, which under Articles 4(11) and 7 must be freely given, specific, informed, unambiguous, and as easy to withdraw as to give. If the upstream consent fails that test, everything built on it fails with it.

The structural lesson sits one level above the consent mechanics. Xandr had a plausible commercial argument. Grindr was the party with the user relationship, Grindr ran the consent flow, and Xandr received a signal that consent existed. The authority rejected the argument anyway, in a sentence that every compliance team should copy onto a whiteboard. Accountability cannot be outsourced.

The text of Article 7 explains why that holds. It puts the burden of proof on the controller, who must be able to demonstrate that the data subject consented. A signal from a partner that consent exists is not a demonstration. A demonstration is a record you can open, showing what the person agreed to, when, for which purposes, and that the agreement covers your own processing.

Read from a CISO’s chair, this is a data lineage problem more than a legal one. The question is whether you can trace a record from the moment it entered your environment to the recipient that now holds it, and attach the legal basis you relied on at each step. Organizations that can answer that question quickly are rare. Organizations that can answer it for data moving by email and file sharing, outside any single application, are rarer still.

How a Contract Clause Failed to Contain Joint Controllership

The authority found that Xandr was a joint controller with Grindr, acting as both a supply-side platform and a demand-side platform in the auction. The reasoning turned on what the decision describes as converging decisions on the purposes and means of processing. Xandr’s own contractual framework and platform shaped which data and which recipients were involved.

Xandr’s contracts prohibited partners from sharing special category data. That clause did not change the outcome. The authority rejected the clause as a sufficient safeguard and concluded that Xandr was a joint controller with Grindr. A prohibition on paper does not help when the system you built carries the data anyway.

The wording of Article 26 points the same way. Joint controllers must transparently allocate their respective responsibilities, and the data subject may exercise rights against each of them. The decision cites Article 26(1) and states that an arrangement between joint controllers does not remove any party’s obligations.

For a compliance officer, this is the part of the ruling that should prompt an inventory. Every data sharing arrangement that involves a shared platform, a shared console, a shared set of standards, or a shared pipeline carries joint controllership risk, whatever the paperwork says. A joint controller arrangement is a description of reality. It cannot create a different reality.

The Pattern Beyond Adtech

It would be comfortable to file this decision under advertising and move on. The enforcement numbers argue against it. The GDPR Fines and Data Breach Survey from DLA Piper reports that aggregate GDPR fines from the date the regulation took effect on May 25, 2018 through January 10, 2026 stand at EUR 7.1 billion, with European supervisory authorities issuing roughly EUR 1.2 billion in fines during 2025 alone.

Enforcement at that scale does not come from one sector. It comes from authorities that have learned to ask the same set of questions of every controller, and the Xandr decision shows what one of those questions looks like when it is applied to a data supply chain. Who gave you this data, on what basis, and how do you know?

The volume of incidents that feed the process is also climbing. DLA Piper’s February 2026 analysis found that European authorities received an average of 443 breach notifications per day, a 22 percent annual increase. Each notification is a moment where a regulator can ask a controller to explain where its data went and who else held it.

None of this is exclusive to organizations that trade in personal data for a living. A hospital sharing referral records with a partner clinic, a bank sending customer files to a service provider, and a manufacturer passing employee data to a payroll processor all send personal data to another party. They differ from Xandr in scale and intent, and they share its exposure to a regulator who asks whether the receiving party’s basis covers the way the data is used. The channel does not change the question. Email, file sharing, APIs, and AI agents all move personal data between people, machines, and systems, and each movement is a place where accountability either holds or does not.

What Regulators Now Expect You to Prove

The exposure is not trivial. Article 83(5) of the GDPR places infringements of Articles 5, 6, 7, and 9 in the higher fine tier, with a maximum of EUR 20 million or, for an undertaking, up to 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. Those are the articles at the center of the Xandr decision.

Fine ceilings get attention, but the more useful signal for a compliance leader is what the authority expected the controller to have done. Verify consent for its own processing. Confirm that the consent covered the specific use. Keep the record. Those are three activities, and none of them is a technology purchase. They are evidence practices.

The evidence gap is visible in the survey data. In Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report, 63 percent of the 459 security, compliance, and technology professionals surveyed reported a compliance consequence in the prior 12 months, defined as an audit finding, a required remediation plan, a board escalation, a contractual penalty, or a formal regulatory investigation. The figures are self-reported, and half the sample was based in the EU and UK, so read the number as directional rather than as a census.

Sovereignty pressure is rising alongside it. A BARC Data Sovereignty 2026 survey of 320 companies, fielded in February and March 2026, found that 51 percent now rate data sovereignty as very important, up from 42 percent in 2025, while only 10 percent have a dedicated budget for it. A gap between how important a control is and how well it is funded is exactly where an enforcement action finds its facts.

Put those pieces together and the compliance officer’s problem comes into focus. The regulator will not ask whether you have a policy. The regulator will ask for the evidence that the policy ran on a specific transfer, on a specific day, for a specific recipient.

Where Governed Data Exchange Fits

Start with what a governed exchange does not do. It does not decide whether a consent is valid, and it does not replace the legal judgment of your data protection officer or counsel. A consent management platform governs collection. A legal team decides whether a basis exists. What sits between those two and the recipient is the exchange itself, the moment personal data leaves your control by email, file sharing, API, or an AI agent. That is where Kiteworks secure data exchange operates.

At that point, the platform lets you turn your own decisions into enforced rules. Data policies, which Kiteworks implements as attribute-based access controls, evaluate three things together, namely attributes of the data, such as its folder path or tag, attributes of the sender and recipient, such as domain or profile, and the action being attempted. The data policy engine can then allow the action, block it, or hold it for approval from a named approver before a send or share completes.

Classification supports that enforcement. Policies can apply a tag when data is uploaded or attached, for example a tag for health data or another special category, and later policies can use the tag as a condition. Data classification done at the point of entry means a decision about Article 9 data is made once and then applied every time the data moves.

The platform can also capture the reasoning. A policy can require a form on upload or download, so the person records a classification or a justification, and that record is stored in the audit log alongside the event. For a team that must show why a transfer happened, a recorded justification attached to the transaction is stronger than a recollection assembled months later. GDPR web forms extend the same idea to data collected directly from individuals.

Evidence is the other half. Kiteworks tracks user, data, and system activity in a single audit trail rather than fragmenting it across subsystems, and it does not throttle log volume during traffic surges. Entries feed external SIEM tools in real time through syslog or the Splunk Universal Forwarder. A compliance officer who needs to show who sent what to whom, when, and where can read it from one record.

For organizations that must keep data inside a jurisdiction, data sovereignty compliance controls let an administrator assign users to a country in a distributed deployment, so their data is stored and routed only through that location, and built-in reporting shows auditors where it sits. Where an organization licenses Kiteworks Advanced Governance, the GDPR Compliance Report adds a summary of policy settings, configuration, and monitored operations. Neither feature certifies compliance. They give you material to demonstrate your own.

A Review Checklist for DPOs and CISOs

The decision invites a practical review, and the review does not need a new tool to begin. It needs a calendar slot and honest answers.

1. List every outbound flow of personal data. Include email, file sharing, API connections, and any AI agent that can send or receive data. Name the recipient and the stated basis for each flow, because a flow with no named recipient has no defensible basis.
2. Compare upstream consent with your actual use. For each case where a partner collected consent on your behalf, write down what the person was told, what they agreed to, and whether your processing falls inside it. If you cannot write that down, you have found a gap.
3. Classify special category data at entry. Health, sexual orientation, and other Article 9 data should carry a label from the moment it arrives, so that policy can act on it without a human remembering to.
4. Gate transfers by recipient and data type. Write policies that allow, block, or hold for approval, and test them against the awkward cases such as a recipient on a free email domain or a recipient in a country you do not operate in.
5. Record the justification at the time of the transfer. A short form completed when the data moves is easier to defend than a reconstruction after a regulator’s letter arrives.
6. Rehearse the evidence request. Choose one real transfer and ask your team to produce its full record in two working days. The time it takes is your actual readiness.

This post is general information, not legal advice. Binding guidance on how the decision applies to your processing must come from your legal team or your data protection officer.

To learn more about enforcing and evidencing your own consent and data sharing decisions across email, file sharing, APIs, and AI agents, schedule a custom demo today.

Additional Resources

• Blog Post The Tug-of-War Over Your Data: How the CLOUD and SHIELD Acts Pit Security vs. Privacy
• Blog Post Secure Sensitive Data by Mapping DSPM to Your Compliance Goals
• Brief Top 3 FERPA Violations and How to Avoid Them
• Blog Post Executive Order 14117: Protecting Americans’ Bulk Sensitive Personal Data
• Blog Post Need NIS2 Compliance? Start With ISO 27001