Norway fines Xandr NOK 92 million over Grindr data: assumed consent rejected, user count not established

627 days, three data points, and no count of people

Norway's data protection authority, Datatilsynet, set the period it examined at 20 July 2018 to 7 April 2020. That is 627 days, or 20 months and 18 days (derived), which its press release calls "almost two years". In that window it found it proven, "by clear preponderance of probability", that Xandr Inc. processed three things about Grindr users in Norway: the fact that they were using Grindr, their advertising ID and their IP address. It fined Xandr NOK 92,000,000 for processing personal data without a legal basis (Article 6(1) GDPR) and for processing data concerning sexual orientation without a valid exemption (Article 9(1)).

The decision does not say how many people that was. The authority writes that it "does not know how many bid requests related to Grindr users Xandr received or shared", so it does not know "the exact number of data subjects affected", and it put no weight on the number in setting the fine. Xandr told it that the data would have been deleted under its retention policy, and that it did not receive Grindr requests in every month of the period. The test evidence the authority relies on covers 176 of the 627 days, which is 28 per cent (derived). No per-user figure can be computed. This site could work one out for Sweden's Miljodata fine because that case had a count of 2.2 million people. This one has none.

This briefing reads the decision itself: a 54-page English-language PDF, reference 20/03541-37, dated 2 October 2026 and published on 12 October with the authority's press release. It is a redacted public version, and black boxes cover Xandr's turnover figures. The press releases of the authority, the Norwegian Consumer Council and noyb were read in full. The Norwegian texts and a German report were read in the original and are translated here by this briefing. The Hacker News report of 13 October was read for what it says and is checked against the decision below. Reuters's own site answered with an authorisation error (HTTP 401) and was not bypassed, so only one syndicated line of its report was read. Every source was read on 14 October 2026 between 06:33 and 07:02 BST.

So the finding is firm on roles and consent and silent on scale. The authority holds that a company in the middle of a real-time bidding chain cannot rest on an app's consent it never checked. That is the part a UK publisher or ad buyer can test against its own set-up. The amount, the user count and the recipients are the parts it cannot.

What was reported, and what the decision says

Most of the coverage follows the press release, and the press release is shorter than the decision. The table sets eight reported points against the decision's own text. "The Hacker News" below means its 13 October report.

Reported points against the decision (reference 20/03541-37) and the authority's press release of 12 October 2026. Rates and ratios marked derived are this briefing's arithmetic.

Reported	What the decision or press release says	Match
Fine of EUR 8.6 million, or $9.62 million (The Hacker News)	The fine is NOK 92,000,000. The decision converts it at Norges Bank's 15 September 2026 rates to "approximately EUR 8 500 000". The press release says EUR 8.6 million and noyb says EUR 8.5 million. The Hacker News's two figures imply 1.1186 dollars to the euro (derived). The decision's own rates imply 1.1540 (derived), which would make the fine $9.84 million (derived). A syndicated Reuters line gives $9.61 million.	Same fine, three conversions
Largest fine the authority has issued	The press release says it is the highest the authority has issued. The 2021 Grindr fine was NOK 65,000,000, so this one is 41.5 per cent higher in kroner (derived).	Matches
Calculated on Xandr's total annual turnover "during the two-year time period", before Microsoft's acquisition (The Hacker News)	The press release says Xandr's own total annual turnover was used, not Microsoft's. The decision ties the revenue figure to the financial year 1 July 2024 to 30 June 2025, which starts 756 days after Microsoft's acquisition on 6 June 2022 (derived). The revenue and the percentage it gives are redacted.	Differs on the year
AT&T bought AppNexus in June 2018; Microsoft bought Xandr in late December 2021 (The Hacker News)	The decision says the AT&T transaction closed on 15 August 2018, AppNexus was renamed Xandr on 1 July 2019, and Microsoft acquired Xandr on 6 June 2022. December 2021 is when Microsoft announced the deal: the decision's footnote links to a Microsoft post of that month.	Dates differ
A complaint by the Consumer Council along with noyb (The Hacker News)	The decision says the Consumer Council lodged the complaint on 14 January 2020, representing a Norwegian data subject. noyb's release says it filed in cooperation with the Council. The Council's release says the legal analysis was done with noyb.	Consistent, wording differs
Thousands of users in Norway (press release, The Hacker News)	The decision's sentence about thousands concerns Grindr's own sharing, citing a court judgment in the Grindr case. For Xandr it says it does not know the number and gives it no weight.	Wider than the decision's evidence
Data relayed to potentially thousands of other companies	Xandr's list of third-party providers included more than 4,000 companies at the time, covering bidders, real-time data providers and others. The decision says Xandr shared the data with "an unknown number of companies".	A list, not a count
Xandr has three weeks to appeal	Three weeks from receipt of the decision letter. The receipt date is not stated. If it arrived on the decision date, the three weeks would end on 23 October 2026 (derived).	Open

What the authority found, and on what standard

The standard is "clear preponderance of probability" (in Norwegian, klar sannsynlighetsovervekt), applied element by element. The authority notes that a fine counts as a criminal penalty under the European Convention on Human Rights, and that it can only be imposed for intentional or negligent infringement. The data found are the fact of using Grindr (carried by the app name, ID or URL in the request), the advertising ID and the IP address. The technical evidence is a 2019 test commissioned by the Consumer Council, which saw Xandr's platform receive those three items in a request routed through the MoPub mediation SDK. The test report lists other companies as receiving GPS location, age and gender. It does not list Xandr among them, and the decision does not find that location, age or gender reached Xandr. For the rest of the period the finding rests on Xandr's confirmation that it received and processed requests for Norwegian Grindr users, on its privacy policy and contract template, and on the authority's view that it is "far more likely than not" that the same fields were in the requests.

That those three items are data concerning sexual orientation follows, in the decision, from the Grindr case: being a user of the app strongly indicates membership of a sexual minority. Three Norwegian bodies upheld that reading, ending with the Borgarting Court of Appeal on 21 October 2025, and the authority says the judgment became final in November 2025. The decision adds that the EU Court of Justice reads special category data broadly, including data that reveals a category indirectly, whether or not the inference is correct.

Xandr was found to be a joint controller with Grindr in both the supply-side and the demand-side role. For the demand side, Xandr's own submission of 2 October 2023 confirmed joint control. For the supply side it said it was partly a processor. Grindr said there was no controller-processor relationship at all. The authority found joint control from the framework Xandr supplied, the Console settings it presented and its own purposes. Xandr never asked users for consent. It relied on Grindr's, which the Grindr case had found invalid, and did not verify it. It also did not say in plain text which legal basis it relied on. Its privacy policy said it normally relies on legitimate interests and in some cases on consent obtained by the app operator. The authority treated consent as the basis the facts pointed to, and held that for special category data consent was the only basis available.

It found the infringements at least negligent: Xandr "devised a system in which it effectively outsourced the necessary assessments". Four factors raised the fine: the nature, gravity and duration of the infringement, the lack of measures, the special category data and the financial benefit. Two lowered it: Xandr's attendance at a voluntary meeting in February 2025, and the length of the case. The starting amount and the size of the reduction are not stated.

One finding is easy to miss. Xandr could not produce some documentation because it had been deleted under its retention policy between 16 July 2020 and 6 February 2023, although it had known of the investigation since 21 February 2020. The authority held that this "cannot be invoked in Xandr's favour" and that the burden of showing compliance under Article 5(2) stayed with Xandr. The window between the two dates is 935 days (derived).

What the decision states, and what it does not, on the points a reader would ask first. Read in full on 14 October 2026. "Not stated" means not found in the published text, which is redacted in places; it does not mean the information does not exist.

The question	Stated	Not stated
How many users in Norway?	"Thousands of Grindr users", as to Grindr's own sharing, citing a court judgment.	The number affected by Xandr's processing. The authority placed no weight on it.
How many bid requests?	Xandr confirmed it received and processed requests for Norwegian Grindr users in the period, but not in every month.	A count, which months, any per-user figure.
Which data?	At least the use of Grindr (app name, ID or URL), advertising ID and IP address.	Location, age, gender or profile content reaching Xandr. The test report lists those going to other companies.
Who received it?	Xandr's list held more than 4,000 companies at the time, and the data went to an unknown number of them.	Which companies received Grindr users' data, in which auctions, or whether any is under investigation.
Consent signals?	Xandr obtained no consent itself and relied on Grindr's, which were invalid.	Whether bid requests carried any consent signal, or what such a signal said. The decision discusses verification, not signals.
Xandr's legal basis?	Xandr did not answer the question on legitimate interests, and its privacy policy was too vague. The authority inferred consent.	A legal basis, in plain text, from Xandr.
Size of the company and the fine?	Revenue for the year 1 July 2024 to 30 June 2025 was used. EUR 20,000,000 was higher than 4 per cent of it. The fine was reduced for the length of the case.	The revenue, the percentage of it, the starting amount and the reduction. All redacted or not given.
Any actual harm?	Misuse of such data "could put the data subject's fundamental rights and freedoms at risk".	Any evidence that a person was outed, targeted or discriminated against.
Appeal?	Three weeks from receipt. If the authority upholds the decision, it goes to the Privacy Appeals Board.	The receipt date, and whether Xandr or Microsoft will appeal.

One request, four steps

The decision describes the path of one ad request. The diagram puts the authority's findings and its silences on each step, and draws the 627-day period to scale with the 176-day test window inside it.

Friendly names that did the work of controls

A label is not a measurement and a contract clause is not a control. The press release calls Xandr an intermediary that "relayed" the data, and the decision's word is joint controller. The table sets eight such comforts against what the decision does with each.

Labels and assurances in the story, who used them, and what the decision does with each. Quotations are short and exact.

The label or assurance	Used by	What the decision does with it
"Intermediary" that "relayed" the data	The press release	Joint controller as both supply-side and demand-side platform. The word names a position in the chain, not a lack of responsibility.
Processor	Xandr, for part of its supply-side processing	"A formal agreement therefore cannot solve a situation where no entity accepts controllership in practice." Grindr denied a processor relationship, so the authority says data subjects' rights "would be entirely undermined".
Grindr's "instructions", given by Console settings	Xandr	Grindr could exclude data categories and recipients, but Xandr built the framework and chose the defaults. Where settings were not changed, requests went out under "standards selected by Xandr".
A contract clause banning special category data	Xandr (clause 6.1 of its standard terms)	A contractual commitment between controllers "does not relieve Xandr of its responsibility" when it in fact processed sensitive data.
"Pseudonymous identifiers"	Xandr's own submission; its 2019 privacy policy	Advertising ID and IP address are online identifiers under Article 4(1). The Council's report quotes the policy: "We do not collect personal data that identifies you as an individual in the 'real world.'" The authority found the person identifiable indirectly.
An SDK that truncates EU users' IP addresses	MoPub's documentation	The decision says "the technical testing showed that the MoPub SDK was transmitting the full IP address to Xandr". The documented control did not match the traffic.
OpenRTB fields are "recommended" or optional	Xandr	Not strictly required, but "integral to making the services profitable" and standard practice, so the authority assumed they were sent.
"We assumed Grindr had collected consent"	Xandr, as the press release reports it	Xandr "omitted to verify" it. Assumption is a hope, and the decision says: "Compliance can never be outsourced."

How this differs from the Grindr decision

Datatilsynet fined Grindr itself NOK 65,000,000 on 13 December 2021, after notifying NOK 100,000,000. The 2021 decision examined the same window, 20 July 2018 to 7 April 2020, because Grindr deployed a new consent platform for people in the EEA on 8 April 2020. The Xandr decision borrows its two hardest findings from that case: that Grindr's consents were invalid, and that being a Grindr user is data concerning sexual orientation. Three Norwegian bodies have already upheld both. Xandr was not a party to that case and could argue them again, but it would be arguing against three decisions. That is an inference from how the decision is built, not a prediction.

The two Norwegian decisions side by side. The Grindr column is from the 13 December 2021 decision and the authority's 2025 news item; the Xandr column is from the 2 October 2026 decision. Percentages and ratios are derived.

Point	Grindr, 13 December 2021	Xandr, 2 October 2026
Role	Publisher of the app, controller of its disclosures to ad partners.	Ad technology company in the chain, joint controller as supply-side and demand-side platform.
Window	20 July 2018 to 7 April 2020.	The same window.
Data established	Advertising ID, IP address, GPS location, age, gender, device information and the app name or ID.	At least the use of Grindr, advertising ID and IP address.
Consent	Collected by Grindr; found not freely given, specific, informed or unambiguous, and not as easy to withdraw as to give.	None collected. Relied on Grindr's and did not verify it.
Fine	NOK 65,000,000, about 32 per cent of the EUR 20,000,000 maximum (the decision's words).	NOK 92,000,000, which is 42.6 per cent of the same maximum (derived), and 41.5 per cent more in kroner (derived).
Turnover	Redacted in the published text.	Redacted in the published text.
Status	Upheld by the Privacy Appeals Board (September 2023), Oslo District Court (2024) and Borgarting Court of Appeal (21 October 2025). Final in November 2025.	Appealable within three weeks of receipt. No appeal body or court has reviewed it.
Each side's account of the relationship	Grindr said it had no direct relationship with Xandr and no controller-processor relationship.	Xandr said it had a contract with Grindr and was partly a processor. The authority did not rely on either account.

The turnover arithmetic is the one thing the redaction does not fully hide. The decision says EUR 20,000,000 was the higher of the two Article 83(5) limits, meaning 4 per cent of Xandr's turnover is below EUR 20,000,000. That puts the turnover below EUR 500,000,000 and the fine above 1.7 per cent of it (both derived). The decision states the exact percentage, but it is one of the redacted figures. It also says the fine falls inside the EDPB's range of EUR 4,000,000 to EUR 20,000,000 for infringements of high seriousness.

Microsoft's position, read as any vendor's

Microsoft told Reuters, according to The Hacker News, that it is reviewing the decision and assessing its options. A German-language report by netzpolitik.org, which this briefing translated, quotes a Microsoft spokesperson as saying the investigation and decision relate to conduct before Microsoft's acquisition of Xandr, and that the "interpretation and application of legal standards and practices" have developed since. The MLex service's summary, of which only the lede is public, says Microsoft said the conduct predated its acquisition and that it was reviewing the decision.

That is a company statement, from a company with a commercial and legal interest in a smaller outcome: it owns Xandr now. What the dates say is that the 627-day window ended 790 days before Microsoft's acquisition on 6 June 2022, and that Xandr told the authority its business relationship with Grindr ended in October 2021, about seven to eight months before that acquisition (derived). The authority agrees on the point Microsoft raises: it did not use Microsoft's turnover because Xandr was not part of Microsoft in the period. On the point that standards have since developed, Xandr made the same argument to the authority, which replied that the rules in Article 9 were clear and foreseeable and that Court of Justice judgments apply retroactively. The ICO's published position that special category data in bid requests needs explicit consent is dated 20 June 2019, which is day 335 of the 627 (derived). That report concerns the UK regime and the Norwegian decision does not cite it. Whether Xandr or Microsoft will appeal is not stated in anything read.

The UK: the ICO on real-time bidding, joint controllers, special category data and PECR

The Norwegian decision does not bind the UK. It says its own competence is limited to protecting users in Norwegian territory. It also leans on EU Court of Justice judgments and European Data Protection Board guidelines, and the ICO says on its special category data page that EDPB guidelines are not binding under the UK regime, though they may still help. What follows reads UK law and ICO pages as published on 14 October 2026, and says where each stops.

UK law and ICO material as read on 14 October 2026 on ico.org.uk, gov.uk and legislation.gov.uk. Quotations are short and exact; the third column says where each source stops.

UK source	What it says	Where it stops
ICO [update report on adtech and real-time bidding](https://ico.org.uk/media2/migrated/2615156/adtech-real-time-bidding-report-201906-dl191220.pdf), 20 June 2019, and ICO [report for DSIT](https://ico.org.uk/media2/yefdqvk4/20260505-report-for-dsit-on-changes-to-regulation-6-pecr-for-online-advertising.pdf), May 2026	2019: for special category data in bid requests "The only applicable condition is explicit consent", and the consent requests then in use were non-compliant. 2026: "many of the issues associated with RTB that we identified in 2019 still exist today", including invalid consent and unlawful processing of special category data for lack of explicit consent.	Reports and advice, not a decision on a named company. The 2026 report advises government on possible exceptions. The ICO's [blog of 18 May 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/our-advice-to-government-on-potential-changes-to-online-advertising-rules/) says "nothing has changed at this stage". Its [online tracking page](https://ico.org.uk/about-the-ico/what-we-do/our-work-on-online-tracking/) lists the 2019 report as its RTB publication and no enforcement decision on an RTB intermediary. That page is not a register, so it does not prove none exists.
[UK GDPR Article 9](https://www.legislation.gov.uk/eur/2016/679/article/9) and the ICO's [special category data](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/) and [rules](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-rules-on-special-category-data/) pages	Article 9(1) prohibits processing "data concerning a natural person's sex life or sexual orientation" without a condition. On inference the ICO says that if a processor makes an inference linked to a special category, or treats people differently because of one, it is processing special category data "regardless of how confident you are that the inference is correct". Its example is targeted advertising. Explicit consent "must be expressly confirmed in words".	The ICO's test turns on intending to infer or to treat differently. The Norwegian decision treats being a Grindr user as itself data concerning sexual orientation. Whether a UK court would do the same on these facts is not settled by the pages read. Both ICO pages carry a notice that they are under review because of the Data (Use and Access) Act.
[UK GDPR Article 26](https://www.legislation.gov.uk/eur/2016/679/article/26) and the ICO's [joint controllers page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-joint-controllers/)	Joint controllers must in a transparent manner set out their responsibilities by an arrangement, and its essence must be made available to the person. Whatever it says, the person "may exercise his or her rights" against each controller. The ICO adds that "each controller remains responsible" and that individuals can claim compensation from each.	The ICO's [controller page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) says joint controllers have "the same or shared purposes". The Norwegian decision found joint control from converging decisions and inseparable processing. Which approach a UK regulator or court would take to Xandr's facts is not something this briefing can say. Failing Article 26 sits in the lower fine tier of [Article 83(4)](https://www.legislation.gov.uk/eur/2016/679/article/83), up to GBP 8,700,000 or 2 per cent. Articles 5, 6, 7 and 9 sit in Article 83(5), up to GBP 17,500,000 or 4 per cent.
ICO [guidance on valid consent](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/) and on [online advertising](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-the-rules-apply-to-online-advertising/)	The consent request must "name any third party controllers who will be relying on the consent". If you buy in consented data, it is "only valid for your processing if you were specifically identified". For advertising, "you must ensure that the user's consent applies across the chain". The ICO's example has a buyer going back to its data supplier to ask whether the consent is valid and whether withdrawals reach it.	Guidance, not a ruling. It is the UK counterpart to the duty to verify that Xandr was found to have ignored, and it is expressed as what organisations should do, not as a finding against anyone.
PECR regulation 6 and the ICO's [storage and access technologies guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/), finalised 29 April 2026	Storing or accessing information on a device needs consent unless an exception applies, and "the use of storage and access technologies for online advertising purposes requires consent". [Mobile apps](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-pecr-rules/) are covered: the app provider is responsible for "understanding the behaviour" of any third-party software components it includes. The ICO's [audit steps](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-comply-with-the-pecr-rules/) include, in any mobile app, to "identify the installed SDKs and their respective data flows".	PECR governs what the app stores on or reads from the device. The onward flow between ad servers in the Norwegian case falls to the UK GDPR, not PECR. PECR consent is defined by the UK GDPR, so its tests for valid consent apply here too.
Data (Use and Access) Act 2025, per the ICO's [hub](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/) and [overview](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), and gov.uk's [summary](https://www.gov.uk/guidance/data-use-and-access-act-2025-data-protection-and-privacy-changes) and [PEC factsheet](https://www.gov.uk/government/publications/data-use-and-access-act-2025-factsheets/data-use-and-access-act-factsheet-pec-regulations)	The ICO says all the data protection and PECR provisions are in force (guidance updated 19 June 2026). Regulation 6 is now a general prohibition with exceptions in a new Schedule A1, including statistical purposes. The ICO's report for DSIT says none of the six exceptions "enables the use of storage and access technologies for online advertising purposes without consent". gov.uk says the Act [aligns PECR sanctions](https://www.gov.uk/government/publications/data-use-and-access-act-2025-factsheets/data-use-and-access-act-factsheet-ico) ("powers and fines") with the DPA 2018. The automated decision-making change does not apply to special category data.	No advertising exception exists. Government has a power to add exceptions by regulation after consulting the ICO, and has not used it for advertising on anything read. The ICO's own [PECR enforcement page](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-happens-if-we-don-t-comply/) still says the new regime is to come and the Regulatory Action Policy applies, so it lags its hub. Nothing read changes Article 9 or Article 26.

The UK also has a Grindr story, and it is a different one. Grindr's Form 8-K to the US Securities and Exchange Commission, filed on 4 September 2026, says that on 2 September it resolved a UK group action in the High Court brought for UK users up to early 2020, over "historical data practices before 2020". It will pay GBP 13.0 million by 31 December 2026 and GBP 13.0 million by 31 March 2027, which is GBP 26 million in all (derived). The settlement "includes no findings or admission of liability", and Grindr "disputes the allegations". The filing gives no claimant number and does not mention HIV status, advertising partners or Xandr. Press reports say the claim concerned HIV status and other sensitive data shared with third parties, and give 12,000 claimants (Irish Legal News) or more than 10,000 (The Hacker News). They differ on the recipients: Irish Legal News says advertisers, while The Register ties the claim to 2018 research on two analytics vendors, not to real-time bidding. Nothing read connects it to Xandr or to the Norwegian case, and the High Court claim itself was not read. The amounts are not comparable with the Norwegian fine: they are a settlement with no admission, in another currency, between other parties.

What to do, in the order worth doing

This list is for a UK organisation that publishes an app with advertising SDKs, or buys programmatic ad inventory. Each step is tied to something the decision found or something the ICO has published. None needs the Xandr decision to be upheld on appeal.

Steps 2 and 3 are the ones the Xandr facts press hardest. A UK publisher whose app reveals a special category, with advertising on it and consent that names no recipients, is in the position Grindr was in. A UK buyer that takes such requests on trust is in the position Xandr was.

What could not be verified

• The turnover and the percentage. Redacted in the published decision. The cap-based bounds above are derived from the decision's own sentence about the EUR 20,000,000 limit.
• Reuters. Its site returned HTTP 401 and was not bypassed. Microsoft's statement is taken from The Hacker News's account of what it told Reuters and from a German report by netzpolitik.org, translated here. The MLex summary is paywalled; only its lede was read.
• Appeal. Whether Xandr or Microsoft has appealed, and when the decision letter was received, is not stated anywhere read.
• The Consumer Council's English release. Not found; the Norwegian release was read and translated. Its 186-page report and the technical report were read at the Xandr passages only.
• Court of Justice judgments and EDPB guidelines. Read only as the decision cites them.
• The UK Grindr claim. The High Court claim and any court order were not read. The settlement rests on Grindr's own filing and press reports, and the HIV and sexual orientation details rest on the press reports.
• Microsoft's December 2021 announcement. The page no longer loads; the date rests on the decision's footnote and trade reporting, and the 6 June 2022 closing date on the decision.
• Time-stamped. Sources were read between 06:33 and 07:02 BST on 14 October 2026. An appeal, a new statement or a changed page could follow within hours.

The question that exposes the gap

If the ICO, or one of your users, asked tomorrow for the evidence that every company receiving your app's ad requests held valid, explicit consent for its own use of them, would you hand over a consent record, or a contract clause and an assumption?

Key facts