Tinder fined €11 million by Irish regulator over data access failures

Tinder must pay €11 million (about R$ 68 million) after Ireland's Data Protection Commission (DPC) found the dating app failed to give users full access to their own personal data. The company behind the app, MTCH Technology Services Limited, also received an order to bring its data-processing operations into line with European rules within three months.

The investigation, opened in 2020, examined Tinder's "Download My Data" tool, which lets users request and download the information linked to their accounts. The regulator concluded that the tool did not deliver a complete copy of the stored information and failed to tell users which categories of records were excluded, according to Portuguese news site Sic Notícias.

The DPC found violations of the General Data Protection Regulation (GDPR), the European Union law that sets rules for handling personal information and guarantees citizens the right to consult and obtain copies of their own data.

What did the Download My Data tool get wrong?

The regulator identified two specific failures in how the feature worked:

• Certain categories of data were omitted entirely, without the account holders being informed.
• Other categories appeared only in summarized form, which breached the transparency and access requirements written into the legislation.

Deputy Commissioner Graham Doyle said tens of thousands of users turned to the tool during the period the investigation covered. That scale matters: the failures were not edge cases affecting a handful of requests, but a systemic gap in a high-volume automated service.

What did the regulator say about automated tools?

Doyle said automated tools can make it easier for people to exercise the rights the GDPR guarantees and can help companies manage access requests for personal information. But he attached a condition to that endorsement.

Doyle stressed that organizations must communicate transparently and fairly which data they are actually providing. He acknowledged that the law does not necessarily require a complete copy of all personal information in every circumstance — yet users must be told the scope of the records they receive. The promise of a download tool, in other words, counts for little if users cannot tell what has been left out.

The fine and the three-month compliance deadline now sit with MTCH Technology Services Limited. The case sets a marker for any platform that handles data-access requests through automated workflows: convenience does not exempt a company from explaining the limits of what it hands back, and Ireland's regulator has shown it will price that omission in the millions.