Ireland’s Data Protection Commission has fined Tinder parent company Match Group €11m for failing to provide users with a complete copy of their personal data.
The penalty follows a long-running inquiry into how the dating platform handles requests for information under GDPR rules.
The Data Protection Commission (DPC) launched its investigation in January 2020, acting as the lead supervisory authority for Match Group. The inquiry focused on the company’s "Download My Data" tool, which the regulator found failed to provide users with all of their personal data as required by Article 15(3) of the GDPR.
Incomplete Data Access
While the tool allowed users to request their information, the DPC determined that certain categories of data were omitted without notice or provided only in summary form. Data Commissioner Niamh Sweeney explained, "What you would get is the number of times you swiped left or right on a particular day, the time you logged in, or the number of matches you made in a day."
Sweeney said that the tool failed to include critical analytics data, such as a user’s gender, latitude and longitude, and the specific city from which they logged into the service. Deputy commissioner Graham Doyle said that while automated tools can be an efficient way to satisfy access requests, they must remain "fair and transparent to individuals regarding the extent of the data provided."
Match Group Appeal
Match Group has confirmed it intends to challenge the decision, meaning the fine will likely face review by the European Court of Justice. The company maintains that it cooperated with regulators throughout the multi-year investigation.
"We have received the DPC’s decision and have decided to appeal," the company said in a statement. "Throughout this investigation, Tinder collaborated with the DPC, and we maintain our confidence in the privacy safeguards we have established for our users."
Regulatory Enforcement Timeline
The DPC has issued an order requiring Match Group to bring its data processing into compliance within three months. This includes a mandate to provide all relevant data or clearly disclose what information cannot be supplied for privacy reasons.
Since 2021, the DPC has issued nearly €4.5 billion in fines, though only a tiny percentage has been paid to date. Commissioner Sweeney indicated that the commission expects a decision from the European Court within the next 12 to 18 months, which could facilitate the collection of outstanding payments.
DPC Finds Data Tool Excludes Analytics and Geolocation
The DPC found that the "Download My Data" tool excluded analytics information such as user gender, precise geolocation data including latitude and longitude, and the specific city of access.
The company is under a formal order to bring its processing into compliance within three months of the DPC’s decision.
Will the €11m fine be paid immediately?
No, the payment is effectively paused while Match Group pursues an appeal, a process that regulators expect could take over a year to resolve.
Related reading