Joint controller

Under the GDPR, joint controllers are two or more organisations that together decide the purposes and means of processing personal data, and that must set out their respective duties in an arrangement under Article 26.

A controller decides why and how data are processed; a processor acts only on a controller's instructions. When two parties both shape the purposes and means, they are joint controllers. Article 26 requires them to agree who does what, in particular on transparency and on handling individuals' rights. They must make the essence of that arrangement available to the people concerned, and those people can exercise their rights against each controller (GDPR, Article 26, EUR-Lex).

Ad tech creates joint control easily. A publisher that embeds a vendor's tag, and the vendor that collects data through it, may decide on that collection together. On 7 March 2024 the Court of Justice of the EU held that IAB Europe can be a joint controller for recording consent preferences in the TCF. The court added that this joint control does not automatically extend to later processing by publishers and vendors (CJEU, C-604/22, 7 March 2024).

Example: On 2 October 2026 Norway's data protection authority fined Xandr €8.6 million over real-time bidding with data from Grindr users (EDPB, 16 October 2026). It found Xandr a joint controller as both SSP and DSP. Xandr could not rely on the app's consent, the authority held, because each joint controller must check for itself that consent is valid.

Related terms: data processing agreement, legitimate interest, TCF, consent string, CMP.

Authoritative source: Regulation (EU) 2016/679 (GDPR), Article 26, EUR-Lex.