- Does this case really affect me, or is it only a problem for big tech players?
- What exactly happened with Xandr and Grindr?
- What does "sensitive data" mean in an advertising campaign?
- Who is responsible in the RTB chain: the platform or the advertiser running the campaign?
- How big is the risk, really? Market and fine numbers
- What's happening in adtech: European regulators' moves in 2026
- Three concrete scenarios: what changes for an e-commerce, a professional firm, and a manufacturing company?
- How to audit RTB flows: the concrete steps to take now
- What are the most common compliance mistakes in programmatic campaigns?
- How do you know if your RTB compliance is really in order?
- So, is RTB compliance really urgent for your company?
- How we see it at SHM
- Frequently Asked Questions
- Xandr (Microsoft) fined €8.6 million for processing sensitive data in real-time bidding without valid consent: every partner in the advertising chain is independently responsible.
- GDPR fines tied to adtech already exceed €5 billion in total: this isn't a theoretical risk, it's an industry under constant scrutiny.
- If you run programmatic campaigns, check your contracts with tech partners, the validity of consent and the presence of sensitive data in RTB flows before your next campaign.
On October 2, 2026, the Norwegian data protection authority fined Xandr, a Microsoft company, €8.6 million. The reason: using users' sensitive data in automated ad auctions without valid consent. If your company runs programmatic campaigns, this case affects you directly.
Does this case really affect me, or is it only a problem for big tech players?
It affects anyone running programmatic campaigns, including Italian SMEs. The principle is clear: every party in the advertising chain is independently responsible for the validity of consent.
Real-time bidding (RTB), the automated auction system that decides in milliseconds which ad to show to which user, involves dozens of companies for every single ad impression. Xandr was one of them, acting as a platform connecting those who sell ad space and those who buy it.
The problem wasn't that Xandr collected the data directly. It received it from Grindr during the auctions. But the Norwegian authority ruled that relying on another party's consent isn't enough: every participant in the chain must independently verify that consent is valid.
For an Italian company using Google Ads, Meta or any programmatic platform, this means you're part of that chain too. You're not just a platform customer: you're a party involved in data processing.
| Your situation | Concrete risk | why |
|---|---|---|
| You only use Google Ads or Meta in standard mode | Low, but not zero | The platforms handle consent, but you choose the targets and the data used |
| You use third-party DSPs or programmatic platforms | Medium-high | You are jointly responsible for data processing in RTB auctions |
| You upload first-party data (CRM) to the platforms | High if it contains special categories | Data on health, orientation or religion requires explicit consent |
| You use look-alike audiences on sensitive segments | High | The system infers protected categories even if you don't declare them |
What exactly happened with Xandr and Grindr?
Xandr received data from users of Grindr, an app for LGBTQ+ people, during automated ad auctions. That data revealed users' sexual orientation, a category protected by the GDPR that requires explicit consent.
The case began in 2020 with a complaint from the Norwegian Consumer Council. The investigation found that during RTB auctions Xandr received at least three types of data: the device's advertising ID, the IP address and the very fact that the user was using Grindr. That last element is enough to reveal sexual orientation, which is a special category of data under Article 9 of the GDPR, the European regulation on personal data protection.
Processing these categories requires the user's explicit consent. Xandr hadn't collected it directly: it relied on the consent managed by Grindr. The Norwegian authority ruled that this consent was invalid, and that Xandr should have verified it independently.
The EDPB decision, from the European Data Protection Board, sets a principle that applies across the whole chain: responsibility can't be delegated.
| Element | Details |
|---|---|
| Date of final decision | October 2, 2026 |
| Fined party | Xandr Inc. (Microsoft) |
| Fine amount | €8,600,000 |
| GDPR articles violated | Art. 6 (legal basis) and Art. 9 (sensitive data) |
| Origin of the case | Complaint by the Norwegian Consumer Council, 2020 |
| Xandr's role | SSP and DSP platform in Grindr's RTB auctions |
| Main reason | Invalid consent for data on sexual orientation |
What does "sensitive data" mean in an advertising campaign?
The GDPR protects certain categories of data with stricter rules: health, sexual orientation, religion, ethnicity, political opinions. In advertising, even an inference (an automated deduction) about these categories is enough to trigger the obligations.
Many companies think they don't process sensitive data because they don't collect it explicitly. But programmatic platforms build very detailed behavioral profiles. If a user often visits mental health sites, the system can infer a medical condition. If they browse religious content, the system knows it.
Here's the critical point: when you upload a customer list to an ad platform to create a look-alike audience, you don't control which attributes the system uses to find similar people. It might use signals that reveal protected categories.
| Special category (Art. 9 GDPR) | Example in an advertising context | Risk |
|---|---|---|
| Sexual orientation | Users of LGBTQ+ dating apps | Yes High |
| Health | Visitors to pharmaceutical or clinic websites | Yes High |
| Religion | Readers of specific religious content | Yes Medium-high |
| Political opinions | Followers of parties or movements | Yes Medium |
| Ethnic origin | Very specific geographic or language segments | Yes Medium |
Who is responsible in the RTB chain: the platform or the advertiser running the campaign?
Both. The Xandr decision establishes that every party involved in processing data, even one that only receives signals during an auction, is a joint controller and is independently liable.
The programmatic advertising chain involves at least four parties: the advertiser (who runs the campaign), the DSP (the platform that buys ad space), the SSP (the platform that sells ad space) and the publisher (the site that displays the ad). Each one receives and processes user data.
The principle set by the Norwegian authority, and confirmed by the EDPB, is that responsibility does not pass downstream. You can't say, "The platform manages consent, so I'm covered." You have to verify that consent is valid for your specific processing.
This is the same principle behind the €250,000 fine against IAB Europe in 2025, upheld by the Brussels Court of Appeal: the TC Strings of the TCF framework, the consent signals used in programmatic, are personal data, and whoever uses them is responsible for their validity.
- 1 · Advertiser (you)You define targeting and uploaded dataYou choose the audience segments and upload any CRM lists. You are responsible for the data you bring into the platform.
- 2 · DSP (e.g. DV360, The Trade Desk)Takes part in auctions and receives dataReceives user signals in every auction. It is jointly responsible for the processing.
- 3 · SSP (e.g. Xandr, Magnite)Passes data on to buyersPasses user data to buyers. It must verify the validity of consent independently.
- 4 · PublisherCollects the initial consentManages the cookie banner and user consent. But everyone else must verify that the consent is valid.
How big is the risk, really? Market and fine numbers
GDPR fines related to adtech now total more than €5 billion. In Italy, the Garante has already issued €83.7 million in fines in just the first ten months of 2026.
The Italian digital advertising market is already worth €6.2 billion in 2025, up 11% on the previous year, according to the Digital Innovation Observatories at Politecnico di Milano. Programmatic accounts for a significant share of that total. The more the market grows, the more attention it gets from regulators.
The Italian Garante Privacy increased its fines by 54.5% in 2025 compared to 2024, from €24.4 million to €37.76 million, as reported by iSimply. The 2026 trend is even sharper.
What's happening in adtech: European regulators' moves in 2026
In 2026, European authorities coordinated a specific action on consent transparency in digital campaigns. It's not an isolated initiative: it's a multi-year program.
In March 2026, the EDPB launched its Coordinated Enforcement Framework (CEF) 2026: 25 national data protection authorities are jointly checking compliance with transparency and user information obligations (Articles 12-14 of the GDPR). If you run programmatic campaigns and cookie consent, you're directly in the spotlight.
In 2025, IAB Europe released TCF v2.3, the updated version of the standard framework for managing consent in RTB auctions, to fix ambiguity in the signals. All participants had until February 28, 2026 to adopt it, or be excluded from Google auctions. If your programmatic platform hasn't updated the framework yet, you're out of compliance.
The overall picture is clear: the authorities aren't waiting. If you haven't run these checks, you could find yourself in a tough position during an inspection.
| Event | Date | Impact for advertisers |
|---|---|---|
| Fine against Xandr (Microsoft) | Oct 2026 | Principle: every RTB party verifies consent independently |
| EDPB CEF 2026 on transparency | Mar 2026 | 25 European DPAs check cookie consent and privacy notices |
| IAB Europe TCF v2.3 deadline | Feb 2026 | Platforms that haven't updated are excluded from Google auctions |
| Brussels Court of Appeal on IAB Europe | May 2025 | TC String = personal data; fine upheld at €250,000 |
| BBVA fine for ignoring opt-out | 2025 | Penalty for failing to respect user preferences |
Three concrete scenarios: what changes for an e-commerce, a professional firm, and a manufacturing company?
The risk isn't the same for everyone. It depends on how you use advertising platforms and which data enters your targeting flows.
Illustrative examples: the numbers and situations are meant to show the reasoning, they are not real customer data.
| Company type | Typical situation | RTB risk | Priority action |
|---|---|---|---|
| Health/wellness e-commerce | Retargeting visitors of specific product pages (supplements, medicines) | High: browsing data reveals health conditions | Audit retargeting segments and check exclusions |
| Professional firm (e.g. legal, psychological) | Lead generation campaigns on Google with industry keywords | Medium: keywords can reveal users' sensitive needs | Review keyword matching and the data passed to the platform |
| B2B manufacturing company | LinkedIn campaigns targeting specific job roles | Low: the data used is professional, not sensitive personal data | Check the data processing agreement with LinkedIn |
How to audit RTB flows: the concrete steps to take now
An RTB audit doesn't require a lawyer's expertise. It requires mapping who receives user data during your campaigns and checking that every party has a valid legal basis.
- 1 · Marketing managerMap the active platformsList every platform that receives user data: DSPs, SSPs, tracking pixels, CRM syncs. Include indirect integrations too.
- 2 · Marketing manager + DPOCheck data processing agreementsEvery platform must have a signed Data Processing Agreement (DPA). Make sure it covers the specific processing you're doing.
- 3 · DPO or privacy consultantIdentify sensitive data in the flowsAnalyze which audience segments you use and whether they could reveal special categories. Include look-alike and behavioral segments.
- 4 · Marketing managerCheck consent on your siteDoes your cookie banner collect valid consent for programmatic? Make sure it's granular, revocable and not pre-ticked.
- 5 · DPO or privacy consultantUpdate the record of processing activitiesDocument every RTB flow in the record of processing activities. In an inspection, it's the first thing they ask for.
- 6 · Marketing managerTest the consent platformCheck that your CMP (consent management platform) is compatible with TCF v2.3. If it isn't, update it before your next campaign.
What are the most common compliance mistakes in programmatic campaigns?
The most common mistake is delegating everything to the platform. The second is not updating the cookie banner when new advertising integrations are added.
As we saw in the Xandr case, relying on consent collected by another party isn't enough. But there are other common mistakes that increase your risk.
- Using audience segments pre-built by the platform without knowing which attributes they include. Some DSP behavioral segments may contain inferences about protected categories.
- Uploading full CRM lists without filtering out sensitive fields. A file with a "condition" or "treatment" column should never end up in an ad platform.
- Not updating your privacy policy when you add a new platform. Every new partner must be listed.
- Ignoring user opt-out requests. As noted in the BBVA fine for an ignored opt-out, this is a standalone, sanctionable risk.
- Not checking partner compliance when their terms change. Platforms often update their terms of service.
How do you know if your RTB compliance is really in order?
Here are concrete indicators you can check without being a legal expert. If even one is negative, it's time to act.
| Indicator | How to check | Risk signal |
|---|---|---|
| DPA contracts with platforms | Search the documents signed with each platform | No signed contract, or an expired one |
| Up-to-date cookie banner | Test the banner in an incognito browser window | Pre-checked consent, or consent not granular by category |
| TCF v2.3-compatible CMP | Ask your CMP provider which version it supports | Version older than v2.3, or no CMP |
| Up-to-date record of processing activities | Check the date of the last update | Not updated in the last 12 months |
| Verified audience segments | Review the descriptions of the segments used in your DSPs | Segments with attributes related to health, religion or orientation |
| Filtered CRM lists | Check the fields in the file uploaded to the platforms | Sensitive fields that were not removed |
So, is RTB compliance really urgent for your company?
Worth it if you run programmatic campaigns with third-party DSPs, upload CRM lists to platforms or use advanced behavioral segments. In these cases, an audit is necessary now, before your next campaign.
Somewhere in between: you only use Google Ads or Meta in standard mode, with no CRM data uploads and no sensitive segments. The risk is low, but it's worth checking your cookie banner and DPA contracts at least once a year.
Not yet if you only run B2B campaigns on LinkedIn with job-role targeting and don't upload personal data. The risk is minimal, but keep an eye on regulatory updates in the industry.
How we see it at SHM
For us, technology is a means to an end: it helps us do better work, not hide from responsibility. The Xandr case makes this crystal clear: using a sophisticated platform doesn't shift legal responsibility to whoever built it.
When we work with companies that run digital campaigns, the first thing we do is map who receives user data and on what legal basis. It's not a bureaucratic exercise: it's the foundation for campaigns that keep working over time, without risks that wipe out your return on investment.
The Xandr fine is not an isolated case. As the €16.7 million Wind Tre fine for telemarketing and the €825 million Uber fine for automated decisions show, regulators are building a consistent framework: every party that processes data is independently accountable. That applies to tech giants, and it applies to Italian SMEs.
If you want to understand how your campaigns stack up against these risks, we can start with an analysis of your active data flows. Explore our strategic AI integration and Google Ads campaign management services, designed for companies that want to grow without exposing themselves to avoidable risks. You can also browse our hub on Project management and technology to stay up to date on digital regulations affecting Italian SMEs.
And if you've already read about the risk of default settings in ad campaigns, you know the problem is never just technical: it's always about conscious choices, too.
Frequently Asked Questions
If you only use the standard features of Google Ads or Meta, without uploading CRM lists or using advanced behavioral segments, the direct risk is low. But you still need to check that your cookie banner is compliant and that you've signed data processing agreements with the platforms. If you upload customer lists or use retargeting, the analysis becomes more urgent.
The GDPR defines special categories of data that require additional protection: health, sexual orientation, religion, ethnicity, political opinions. In programmatic, even an automated inference about these categories, meaning a deduction based on browsing behavior, is enough to trigger the obligations. You don't need to have collected them explicitly.
The TCF (Transparency and Consent Framework) is the standard programmatic platforms use to pass users' consent signals during RTB auctions. Version 2.3, released by IAB Europe in April 2025, became mandatory for taking part in Google auctions by February 2026. If your consent management platform isn't updated to this version, you may be out of compliance.
Yes. The Xandr case makes this explicit: every party involved in data processing must independently verify that consent is valid. You can't hand this responsibility off to the platform or the publisher. You are a joint controller and answer independently.
GDPR fines can reach up to 4% of global annual turnover or €20 million, whichever is higher. For SMEs, the Italian Garante tends to calibrate fines to the size of the company, but the 2026 trend shows a significant increase: €83.7 million issued in just the first ten months of the year.
The first step is to list every platform that receives user data during your campaigns: DSPs, SSPs, tracking pixels, CRM integrations. For each one, check whether you have a signed data processing agreement and whether the consent collected on your website covers that specific processing. This analysis can be done in a few days with the support of a privacy consultant or a DPO.
The Xandr fine isn't news about the past: it describes how programmatic works today, and who is accountable when something goes wrong.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
