Norwegian Data Protection Authority Imposes an Administrative Fine of EUR 8.6 Million for Unlawful Processing of Personal Data

The Norwegian Data Protection Authority has imposed an administrative fine of EUR 8.6 million on an advertising technology company for the unlawful processing of personal data. The announcement published by the European Data Protection Board (“EDPB”) on 16 October 2026 provides details of the decision dated 2 October 2026.

The decision addresses the following key issues:

• The case concerns the processing of personal data belonging to users of a location-based dating application during real-time bidding processes.
• Personal data processed during real-time bidding included information indicating that individuals used the application, advertising IDs and IP addresses. These data qualify as personal data under Article 4(1) of the GDPR.
• Information indicating that individuals used the application was considered, in its specific context, to constitute data concerning sexual orientation and was therefore assessed under Article 9 of the GDPR. The processing was found to have taken place without a valid legal basis or applicable exemption.
• The platform involved in the real-time bidding process was considered a joint controller because it operated as both a supply-side and a demand-side platform. The decision emphasises that each joint controller must fulfil its accountability obligations and independently verify whether the consent obtained is valid and covers its own processing activities.
• The processing relied on consent obtained by the application. However, this consent was not considered valid under Articles 4(11) and 7 of the GDPR.
• The Norwegian Data Protection Authority concluded that Article 6(1) and Article 9(1) of the GDPR had been infringed and imposed an administrative fine of EUR 8.6 million on the company concerned.

You can Access the full text of the ddecision here.