Borrowed Consent Is Not a Defence

Norway's data protection authority has fined the ad-tech company Xandr NOK 92 million for relying on consent that someone else collected and never checking it. The ruling reaches well beyond advertising. If your organisation works with contacts from a lead-generation agency, registrations from a partner's webinar or a pixel on your website, the same logic applies to you.

What happened in Norway

On 12 October 2026, the Norwegian Data Protection Authority (Datatilsynet) announced a fine of NOK 92 million, which the authority puts at roughly EUR 8.6 million. It is the highest fine it has ever issued. The recipient is Xandr, an advertising technology company that is now part of Microsoft.

Between 2018 and 2020, Xandr ran real-time bidding inside the dating app Grindr. When a user opened the app, their data passed through Xandr to potentially thousands of advertisers competing, in a fraction of a second, to show them an ad. According to the EDPB's summary of the decision, the data included at least the fact that the person used Grindr, their advertising ID and their IP address. Using Grindr in itself reveals sexual orientation, which is special category data under Article 9 GDPR. Processing it required explicit consent.

Xandr argued that collecting consent was Grindr's job. The authority rejected that. It found Xandr to be a joint controller, found Grindr's consents invalid, and noted that Xandr had done nothing to verify it had a legal basis for its own processing. The EDPB summary puts it plainly: accountability cannot be outsourced, and each joint controller must independently verify that consent is valid and covers its own processing.

Norway is not an EU member but applies the GDPR through the EEA Agreement. Xandr has three weeks from receipt to appeal, so the decision may not be final. The reasoning behind it, however, comes straight from the text of the GDPR.

Why this matters if you have never touched an ad exchange

Most mid-sized companies do not run an ad exchange. Almost all of them do some version of what Xandr did: they take personal data that someone else collected and trust that it was collected properly.

The GDPR leaves little room here. Under Article 7(1), where processing is based on consent, the controller must be able to demonstrate that the person consented. Not the partner, not the agency: whoever uses the data. Article 5(2) adds that the controller is responsible for compliance with all the principles and must be able to prove it.

The Court of Justice of the EU applied the same logic back in 2019 in Fashion ID (C-40/17). An online retailer had embedded Facebook's "Like" button on its website, and the Court held that the retailer was a joint controller with Facebook for collecting and passing on visitors' data. Obtaining consent for those operations was the retailer's task.

For a board or a compliance lead, the takeaway is simple. "The agency was supposed to handle that" or "it's in the contract" will not hold up in an inspection unless you can produce the evidence.

Four places where you probably rely on someone else's consent

Bought or rented contact lists

An agency delivers a list and assures you that "everyone opted in to marketing". Opted in to marketing from whom? Consent has to be specific and informed, so people must know who they are consenting to. A generic opt-in to "partners" will rarely help you. For email marketing, the ePrivacy Directive (Article 13) also restricts unsolicited messages; in Czechia, for example, Section 7 of Act No. 480/2004 Coll. allows them without prior consent only to your own customers. And because you did not collect the data from the individuals yourself, Article 14 GDPR requires you to tell them who you are and where you got their data, at the latest when you first contact them.

Joint webinars and events

Registration runs through the partner's form, and after the event you receive a spreadsheet of attendees. If the form did not name your company as a recipient and explain what you would use the data for, you have nothing to rely on for follow-up outreach. If you and the partner jointly decide why and how the data is processed, you are joint controllers, and Article 26 GDPR requires an arrangement setting out who does what. That arrangement does not change the fact that each of you answers for its own processing.

Pixels and tracking code on your website

An advertising pixel, an analytics script or an embedded video can send data to third parties the moment a page loads. Your cookie banner may come from an external tool, but its configuration is your responsibility. Article 5(3) of the ePrivacy Directive requires prior consent for storing or reading information on a visitor's device unless it is strictly necessary; in Czechia this is implemented in Section 89(3) of the Electronic Communications Act (Act No. 127/2005 Coll.). The usual failures are familiar: pixels firing before consent and banners where "reject" is harder to find than "accept".

Recruitment agencies and CVs

An agency sends a candidate's CV and adds that it holds consent for its talent pool. That consent covers the agency's processing, not necessarily yours. For your own hiring process you need your own legal basis, and the candidate must know that you hold their data. Incidentally, one German supervisory authority has chosen recruitment agencies as its focus within the European transparency action described below.

A contract is not enough. You need evidence

A supplier's contractual assurance is a reasonable start, but in an inspection only what you can produce counts. For every source of personal data from a third party, you should hold:

• the consent wording in the version people actually saw, including whether it names you as a recipient and for what purpose,
• the date, time and source of each consent (form, URL, campaign), at least for a random sample,
• a clear allocation of roles: is the partner your processor under Article 28, an independent controller, or a joint controller under Article 26,
• a contractual audit right and an obligation to hand over proof of consent on request,
• a route for withdrawals, so that a withdrawal reaches you and is reflected in your systems,
• an entry in your records of processing under Article 30, stating the data source and recipients,
• an Article 14 notice ready for first contact.

The pattern is familiar from another angle. In A Subpoena Is Not a Permission Slip we looked at what happens when a company hands data out without a process. Xandr is the mirror image: taking data in without one.

Why now

The Xandr decision lands in a year when European regulators are looking hard at transparency. On 19 March 2026 the European Data Protection Board (EDPB) launched a coordinated enforcement action on the information obligations in Articles 12 to 14 GDPR. Twenty-five data protection authorities are taking part, contacting controllers across sectors through investigations or questionnaires. They are due to share findings in the second half of the year, and the EDPB will then prepare a consolidated report.

The questions "where did you get this data?" and "how did you tell people?" point at exactly the same spot as the Norwegian ruling: data that reached your organisation by a side door.

Keeping it under control without another binder

The problem in most organisations is not reluctance. It is fragmentation. Sales holds the agency contracts, marketing owns the cookie banner, HR deals with recruiters, and the records of processing were last opened a year ago by someone who has since moved on. When a regulator writes, the answer has to be assembled from five places.

VPoint keeps these workstreams in one place. In the GDPR module you maintain records of processing and run queues for consents and data subject requests, with statutory deadlines tracked and a full audit trail. Vendor due diligence has a named owner and its own evidence: a processor register and signed agreements. And because these mistakes usually start in marketing, sales and HR, the platform turns your own policy into AI-designed training that your team edits and assigns to the right people, with completion on record.

A checklist for next week

• List every route by which personal data reaches you from third parties: agencies, partners, events, your website, recruitment.
• For each one, identify the partner's role and the legal basis you rely on.
• For your two largest sources, request a sample of consent records and check that they name your company.
• Add an audit right and a duty to provide proof of consent to your contracts.
• Check that advertising and analytics code on your website fires only after consent.
• Prepare an Article 14 notice for first contact with people whose data came from someone else.
• Train marketing, sales and HR on what to ask before accepting data from a partner.

Want to see what this overview would look like for your organisation in one place, at one annual price per organisation and with no per-user fees? Book a 30-minute demo.