Irish DPC fines Tinder’s owner €11 million over its data access tool

Ireland’s Data Protection Commission (DPC) has fined MTCH Technology Services Limited, Match Group’s Irish unit, €11 million over shortcomings in the tool Tinder used to answer access requests. The case matters because almost every platform offers a “download my data” button.

What the DPC decided

The inquiry was opened on the DPC’s own initiative in 2020, with the DPC acting as lead supervisory authority. It looked at how Tinder handles access and deletion requests and how long it keeps data. Reports indicate the focus was the self-service “Download My Data” tool, presented as a way to obtain a copy of one’s data but not delivering everything held.

Besides the fine, the DPC issued a reprimand and ordered Match Group to bring its procedures into compliance within three months. According to press reports, that includes providing all relevant data or clearly stating what cannot be supplied for privacy reasons. Categories such as analytics or geolocation data were reportedly omitted or given only in summary form.

Deputy Commissioner Graham Doyle said automated tools can be useful but must show people transparently which data they are receiving.

Appeal and timeline

Match Group has said it will appeal. It had already booked a $12.6 million provision and argues the contested policies were largely designed to protect user safety and privacy. The procedure previously produced preliminary findings (January 2024) and a draft decision (July 2026). With the appeal, payment is on hold until it is resolved.

What platforms should review

• That automated downloads cover every category of personal data, including inferred or analytics data, unless an exemption is justified.
• That any exclusion (for example, to protect third parties) is explained visibly to the user.
• That alternative channels exist when the tool falls short.
• That internal records show which data is processed and where it sits.

Our view at CEA Digital Law

At the Euro-American Committee of Digital Law - CEA Digital Law, we read this decision as a practical reminder: the right of access under Article 15 GDPR is judged by outcome, not by the existence of a tool. A smooth download dashboard does not replace a complete answer.

For Latin America and the Caribbean, where laws such as Brazil’s LGPD and Mexico’s legislation recognise access rights, the lesson is to get ahead: audit data export flows before a regulator does. In Africa, where several young authorities are building their practice, the DPC’s approach offers a useful reference on transparency in self-service tools.

One open question is how to balance full access with the protection of third parties’ data and security. Shared European guidance on the minimum content of such downloads would give companies and users legal certainty while the appeal is pending.

Sources

• Extra.ie: Ireland's data watchdog hands Tinder fine
• Global Dating Insights: Match Group to appeal €11 million GDPR fine
• Archynewsy: Tinder fined €11M over incomplete user data tool
• ua.news (citando a Politico Europe)

CEA Digital Law