Xandr, Inc.
- Complaint filed
- 18.03.2026
- Decision
- 04.05.2026
- Time to decision
- 47 days
- Decision number
2.1-1/26/515-1085-2- GDPR articles
- 12, 15
c285bd4f8b6339967579dafc0d6d883e47086d3acd3faa12a67864be5cad40b9The document is published in full. The complainant's personal data (email address) has been removed from the document.
What was in the complaint
24 February 2026 — an Art. 15 request to privacy@xandr.com. 28 February — repeated to privacy@xandr.com and mscceudpo@microsoft.com. No substantive reply.
18 March — active persistent Xandr identifiers were found in the HAR of the site delfi.ee, in the domain .adnxs.com. They confirm that Xandr processes the complainant’s data at the moment the complaint was filed.
18 March — an attempt to send an updated request via ProtonMail. Both Xandr/Microsoft addresses rejected the letter with the code 550 5.4.1 — “Recipient address rejected: Access denied”. That is, Microsoft actively blocks letters from a secure email service.
Articles: 12(3), 15, blocking of the communication channel.
What AKI decided
Proceedings discontinued. Grounds: Art. 57(1)(f); the controller is in the USA (a subsidiary of Microsoft).
Analysis
Xandr is a subsidiary of Microsoft, and this makes the unreachability especially strange: Microsoft has a European DPO (mscceudpo@microsoft.com), so a presence in the EU is obvious.
A separate detail is the blocking of ProtonMail letters with the 550 code. The right of access under Art. 15 is meaningless if the very channel for making a request is closed to secure email. This is not “they did not reply” — it is “they did not let me make the request”.