The Norwegian Data Protection Authority has imposed a fine of €8,600,000 on Xandr for unlawful processing of personal data, the European Data Protection Board reported.
The case concerns Xandr's handling of personal data in its advertising technology operations. Details of the specific processing activities found to be unlawful were not set out in the published summary.
This enforcement action falls under data protection law rather than the EU AI Act. However, it is relevant to organisations operating in the adtech and digital advertising sector, where data processing practices increasingly intersect with AI-driven profiling and targeting systems.
Fines of this scale underline that data protection authorities across the European Economic Area continue to actively pursue enforcement against large-scale commercial data processing, including activities that may feed into or overlap with AI systems used for advertising personalisation.
For organisations preparing for the EU AI Act, this case is a reminder that compliance obligations under data protection law and AI regulation are not separate workstreams. Many AI systems, particularly those used in advertising, recommendation, or profiling, rely on personal data pipelines that must independently satisfy data protection requirements.
As a compliance matter, organisations developing or deploying AI systems that process personal data should ensure that their data governance practices are reviewed alongside AI Act obligations, rather than treated as a distinct or secondary concern.