Joint controllership: can a business rely on consent obtained by its partner?

On 2 October 2026 the Norwegian Data Protection Authority (Datatilsynet) imposed an administrative fine of NOK 92 million on the American advertising technology company Xandr Inc. (formerly AppNexus, now part of Microsoft) (ref. 20/03541-37). The decision was made public on 12 October 2026, and the authority describes the fine as the largest it has ever imposed. Xandr processed data about Norwegian Grindr users in real-time auctions of advertising space without a valid legal basis, in breach of GDPR Art. 6(1) and of the prohibition on processing special categories of data in GDPR Art. 9(1). The case raises a question that extends well beyond the advertising industry, namely whether a business that receives personal data from a partner may rely on the consent the partner has obtained. This article examines how joint controllership arises, what the accountability principle requires of the recipient, why contractual clauses were insufficient, and what a data sharing agreement should regulate.

What was the Xandr case about?

The case concerned Xandr’s processing of personal data about Grindr users in Norway in the period from 20 July 2018 to 7 April 2020. The Norwegian Consumer Council complained in January 2020 on behalf of a Norwegian user, after a technical analysis had shown which data the Grindr app transmitted to advertising partners. The Norwegian Data Protection Authority found it established on a clear preponderance of probabilities that Xandr processed at least three items of data, namely the fact that the person used Grindr, the person’s advertising ID and the IP address. The advertising ID and the IP address are online identifiers that make the person identifiable within the meaning of GDPR Art. 4(1).

Xandr acted in two roles in the real-time auctions of advertising space in the Grindr app. As a supply-side platform (SSP) the company helped Grindr sell advertising space in the app, and as a demand-side platform (DSP) it placed bids on behalf of advertisers. The platform shared bid requests with a large number of recipients, and according to the decision Xandr’s list of third-party vendors comprised more than 4,000 companies. Grindr was itself fined NOK 65 million in a decision of 13 December 2021, which has since been upheld by the Privacy Appeals Board, Oslo District Court and Borgarting Court of Appeal (judgment of 21 October 2025). The rules on legal basis and consent are collected on the data protection topic page.

When does joint controllership arise?

Joint controllership exists where two or more businesses jointly determine the purposes and means of the processing, as provided in GDPR Art. 26(1). The cooperation may rest on a common decision or on converging decisions which complement each other and each have a tangible impact on the purposes and means. The latter follows from the judgment of the Court of Justice of 7 March 2024 in C-604/22 IAB Europe (paragraph 59). The Court also made clear that joint responsibility does not entail equal responsibility, and that a joint controller need not have access to the data (paragraph 58).

Xandr argued that it was merely a processor for Grindr when acting as a supply-side platform, and relied on an agreement drafted on the basis of that allocation of roles. The Norwegian Data Protection Authority held that the roles are functional and cannot be contracted away, with reference to paragraph 12 of the EDPB Guidelines 07/2020. Xandr designed the platform, determined the default settings and the circle of recipients where Grindr did not adjust them itself, and used the data for its own purposes such as frequency capping, fraud detection and improvement of the platform. The authority also referred to the statement of the EDPB that a party which uses a tool developed by another for its own purposes normally takes part in a joint decision on the means (paragraphs 65–67). The conclusion was that Xandr was a joint controller with Grindr in both roles.

The assessment is of practical importance to providers of platforms, SDKs and data intermediation services. A provider that defines the data fields, the default configuration and the recipients, and which itself benefits from the data, must expect the supervisory authority to disregard an agreement describing the provider as a processor. How the processor role should be delimited in the contractual framework is discussed in the article on data processing agreements for SaaS.

May a joint controller rely on its partner’s consent?

A joint controller may agree that its partner obtains the consent, but both are responsible for ensuring that the consent is valid and covers their own processing. The Norwegian Data Protection Authority based this on the accountability principle in GDPR Art. 5(2) and on the obligation in GDPR Art. 24 to implement, and be able to demonstrate, appropriate measures. Under GDPR Art. 7(1) a controller relying on consent must be able to demonstrate that the data subject has consented. Grindr’s consents did not satisfy the requirements of GDPR Art. 4(11) and GDPR Art. 7, and Xandr had taken no steps to verify them.

“Our main message is that responsibility for data protection cannot be outsourced to others.” (Line Coll, Director of the Norwegian Data Protection Authority, 12 October 2026, our translation)

The authority attached weight to the fact that Xandr was further down the chain and had no contact with the data subjects. In the authority’s view this gave more reason to verify lawfulness, not less. Xandr’s argument that it was not practically possible to verify its customer’s legal basis was rejected, and the authority found the infringement to be at least negligent. The authority further noted that guidance from the Article 29 Working Party on the consent requirements was available at the time of the processing, which would have enabled Xandr to see that Grindr’s solution was inadequate.

The requirements for valid consent are the same regardless of who obtains it. The opinion of the Advocate General in the Canal+ case on consent given on behalf of unidentified “partners” is discussed in the article on marketing consent, and the relationship with cookies in the article on cookie consent.

When does the data reveal special categories?

Data falls within the special categories of GDPR Art. 9(1) even where it only indirectly reveals, for example, sexual orientation or health. The Court of Justice has adopted a broad interpretation in C-184/20 OT and C-21/23 Lindenapotheke, and it is irrelevant whether the inference is correct. The fact that an identifiable person uses Grindr is therefore data concerning sexual orientation. The only relevant exception was explicit consent under GDPR Art. 9(2)(a), and consent was then also the only relevant legal basis under Art. 6.

Xandr argued that before these judgments it was unclear that the use of an app could constitute sensitive data. The Norwegian Data Protection Authority rejected the argument, pointing out that the interpretation given by the Court of Justice has retroactive effect. For businesses receiving data from apps or websites, this means that the context must be assessed. An app ID, a website address or a product category may turn an otherwise neutral identifier into sensitive data. The same applies to location data showing visits to clinics or religious communities, as discussed in the article on location data.

Why did the contractual prohibition not exempt Xandr?

Xandr’s standard terms prohibited Grindr from sharing special categories of personal data. The Norwegian Data Protection Authority found that such a contractual prohibition between controllers does not exempt the recipient where sensitive data is in fact processed. The authority pointed out that, according to the case law of the Court of Justice, it is irrelevant whether the controller intended to process sensitive data. The clause also rebounded on Xandr, because it showed that the company influenced which categories of data were shared and thereby had influence over the essential means of the processing.

The authority treated the agreement on data subjects’ rights in the same way. The agreement presupposed that Grindr was the controller and Xandr the processor, whereas Grindr for its part took the view that no such relationship existed. Since neither party assumed the role of controller, the data subjects were in practice unable to exercise their rights against either of them. Under GDPR Art. 26(3) the data subject may in any event exercise his or her rights against each of the controllers.

What is the significance of the deletion of evidence and the one-stop-shop mechanism?

Xandr deleted documentation in the period from 16 July 2020 to 6 February 2023, although the company had been aware of the investigation since 21 February 2020. The Norwegian Data Protection Authority held that the deletion could not benefit the company, because the burden of proving compliance under GDPR Art. 5(2) lies with the controller. The authority therefore considered it more likely than not that the data was processed in the manner customary in the industry, and rejected the argument that the lengthy proceedings had impaired Xandr’s ability to defend itself. Businesses receiving an enquiry from a supervisory authority should accordingly suspend the ordinary deletion of relevant documentation.

The one-stop-shop mechanism in GDPR Art. 56 did not apply, because Xandr had no main establishment in the EEA during the processing period. The company’s European offices were sales offices without authority over purposes and means, and Microsoft’s subsequent acquisition did not alter this. The Norwegian Data Protection Authority was therefore competent under GDPR Art. 55(1) in respect of users in Norway. A company outside the EEA without a main establishment here may consequently face supervision by several national supervisory authorities for the same processing.

How was the fine calculated?

The fine was calculated on the basis of Xandr’s own turnover and not that of Microsoft, because Microsoft did not own Xandr during the processing period. The Norwegian Data Protection Authority relied in this respect on the competition law case law of the Court of Justice in C-408/12 P YKK. Four per cent of Xandr’s turnover was less than EUR 20 million, so that the maximum under GDPR Art. 83(5) was EUR 20 million. In its report on the decision, the EDPB stated the fine as EUR 8.6 million.

Aggravating weight was given to the nature and duration of the infringement, the absence of measures, the sensitive nature of the data and the financial benefit Xandr derived from the processing. The lengthy proceedings and Xandr’s voluntary participation in a meeting with the authority were regarded as mitigating factors. The decision may be appealed within three weeks of receipt. If the Norwegian Data Protection Authority upholds the decision, the case is referred to the Privacy Appeals Board under Personal Data Act § 22. As at 16 October 2026 it was not known whether Xandr had appealed.

Is the advertiser a joint controller in targeted advertising?

An advertiser that selects targeting criteria on an advertising platform will normally be a joint controller with the platform for the processing on which the targeting depends, as provided in GDPR Art. 26(1). In C-210/16 Wirtschaftsakademie the Court of Justice held that the administrator of a Facebook page takes part in determining the purposes and means of the processing through the parameters it defines, in particular by reference to its target audience. The Court also stressed that using a platform on the provider’s terms does not relieve the user of its own obligations. In C-40/17 Fashion ID the Court made clear that joint responsibility is confined to the processing operations which the parties in fact determine together, and does not extend to the platform’s subsequent processing for its own purposes.

The Berlin Commissioner for Data Protection and Freedom of Information has applied these principles to political parties’ advertising on Facebook in the German federal election of 2021. In its annual report for 2024 (chapter XIII.3) the authority took the view that Meta and the advertising party jointly determined the purposes and means, and should therefore have concluded a transparent arrangement under Art. 26 and made it available to the data subjects. Targeting by presumed political opinion entailed processing of special categories of data under GDPR Art. 9(1). The authority found neither explicit consent nor a substantial public interest capable of providing an exception, and observed that targeted political advertising tends to run counter to the public interest in free elections.

According to German news media and the privacy organisation noyb, which brought the complaints, the authority has now concluded the proceedings against CDU, SPD, Bündnis 90/Die Grünen and Die Linke by decisions dated 24 September 2026. The parties are reported to have received reprimands but no administrative fines, while the proceedings against the AfD remain open. As at 21 October 2026 the authority had not published its own statement on the decisions, and the information on the date and type of measure therefore rests on secondary sources.

The Xandr decision and the Berlin cases show the same pattern of responsibility from opposite ends of the advertising chain. The advertiser’s choice of targeting criteria is a decision about the processing for which the advertiser must itself have a legal basis and be able to account under GDPR Art. 5(2). Criteria that directly or indirectly reveal political opinions, health, religion or sexual orientation require explicit consent under GDPR Art. 9(2)(a), which the advertiser will seldom be able to demonstrate where it is the platform that deals with the user. The advertiser should therefore avoid such criteria and verify that the platform’s terms contain an arrangement under Art. 26 covering the advertiser’s part of the processing. In an article on real-time bidding of 16 October 2026 the Norwegian Data Protection Authority reiterated that it has long advocated a complete ban on behavioural advertising.

What should a data sharing agreement in a joint controllership contain?

An arrangement under GDPR Art. 26 must determine in a transparent manner who does what, and its essence must be made available to the data subjects. In our assessment the agreement should also give the recipient a genuine basis for verifying that the processing is lawful, because the Xandr decision shows that a mere reference to the partner’s obligations is not a sufficient measure under Art. 24. The agreement should therefore regulate at least the following matters between the parties.

1. Describe the roles for each processing activity according to actual influence over purposes and means, and not according to what is commercially desirable.
2. State which consent text is used, which purposes it covers, and that the recipient is named or identifiable to the data subject.
3. Give the recipient the right to obtain consent records for individuals or samples, so that the requirement in Art. 7(1) can be met.
4. Regulate how withdrawals of consent and objections are communicated between the parties, and within what time limit.
5. Map whether the context may reveal special categories, and agree on technical filters in addition to prohibition clauses.
6. Include a right of audit and exercise it, for example through spot checks of the consent flow before launch and whenever changes are made.
7. Set out liability and recourse between the parties in light of GDPR Art. 82(4) and (5), and a right to suspend the data sharing in the event of deficiencies.
8. Require both parties to preserve documentation once a supervisory authority or a data subject has raised a matter.

The agreement does not relieve either party of its own responsibility towards the supervisory authority. Whether an agreed indemnity may cover an administrative fine has not been settled in Norwegian law and should be assessed separately. The practical value of the agreement therefore lies in the verification measures. Before the data sharing begins, the recipient should itself review the partner’s consent solution and document that assessment, so that the business can demonstrate under GDPR Art. 5(2) that it has verified the basis for its own processing.

Questions and answers

Next legal review: 30 November 2026