Tinder fined €11m: its ‘Download My Data’ tool left data out

01What the tool did wrong

The decision is about the right of access under Article 15(3) of the GDPR: a person who asks is entitled to a copy of the personal data a company holds on them. Tinder offered a self-service tool for that. The commission found that although the tool was presented as the way to get a copy of one’s Tinder data, it did not provide all of it, and what it did provide did not meet the requirements of the right of access.¹ Deputy Commissioner Graham Doyle said “tens of thousands” of users used the tool during the period the inquiry assessed.¹

These tools do not need to provide a complete copy of personal data but they must be fair and transparent to individuals regarding the extent of the data provided.

That is the point of the case: an export button may hand over less than everything, if it says so and tells the user how to get the rest. Tinder’s left categories out silently. The commission has not yet published the full decision, so which categories were missing is not public.¹

The case started from complaints. On 4 February 2020 the commission said it had seen issues raised by people in Ireland and across the EU and would examine MTCH’s legal basis for processing, its transparency and how it handled requests from users exercising their rights.² Its 2024 annual report described the inquiry as covering both access requests and erasure requests (Article 17), with MTCH replying to a preliminary draft decision that year.³ The 13 November announcement names only the access finding. As MTCH’s lead authority in the EU, the Irish commission decided the case with the cooperation of its peer regulators.¹

02What Article 15 entitles you to

Under the GDPR, anyone can ask a company whether it holds personal data about them. If it does, they are entitled to:

• A copy of the data itself, the first one free; a reasonable fee is allowed only for further copies. A request made electronically gets an answer in a commonly used electronic form.⁴
• The facts around it: why the data is processed, which categories are held, who it has been or will be shared with, how long it will be kept, where it came from if not from the person, and whether automated decisions or profiling are used, with meaningful information about the logic involved.⁴
• An answer within one month, which the company may extend by two further months for complex or numerous requests, if it says so within the first month.⁴

The one limit in the article is that a copy must not adversely affect the rights and freedoms of others, such as another person’s messages.⁴

Europe is also writing new rules for how apps present choices to users: see our Analysis of the Digital Fairness Act proposal.