Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
Summary: Background informationDate of final decision: 2 October 2026National case Controller: Xandr Inc.Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data)Decision: Administrative fineKey words: Fines, Basic principles, Marketing, Online platformsSummary of the DecisionOrigin of the case The case started in 2020 when …
Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.
What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.
Source: EDPB News