Ireland's data protection authority has imposed an €11 million penalty on Match Group following an investigation into Tinder's "Download My Data" functionality, according to Politico. The regulator determined that the tool failed to furnish users with comprehensive copies of their personal information held by the company.
The Data Protection Commission announced its decision on Friday, stating that the tool either excluded certain data categories entirely or presented them as abbreviated summaries. This approach violated the GDPR's right of access provision, which mandates that individuals receive complete visibility into all data organisations maintain about them.
Beyond the financial penalty, Match Group received a formal reprimand and was given three months to rectify its data handling practices.
Deputy commissioner Graham Doyle acknowledged that automated download systems serve a legitimate purpose in responding to data access requests. However, he emphasised that such tools "must be fair and transparent to individuals regarding the extent of the data provided."
Tinder engaged with the DPC throughout this investigation, and we stand behind the privacy protections we've built for our users
Tinder spokesperson to Politico
The inquiry that led to this decision commenced in early 2020, forming part of a pair of investigations announced by the Irish regulator during the same period. Its counterpart, examining Google's location data practices, concluded in September with a €403 million fine imposed on the search giant.
Nearly six years elapsed between the opening of Tinder's case and the final ruling—a duration that critics have flagged as emblematic of Dublin's enforcement pace regarding EU privacy legislation.
For Match Group's financial position, the penalty carries minimal significance. The company had previously cautioned shareholders that potential exposure could reach $60 million, and by mid-2026 had reserved $9.1 million against the case in its financial statements. The €11 million fine slightly exceeds the reserve but remains substantially beneath the maximum warning.
The DPC functions as the primary EU privacy regulator for the majority of American technology companies owing to their Irish registration, and its enforcement record has intensified recently. In July, the Irish High Court upheld the commission's €530 million fine against TikTok concerning data transfers to China.
Though smaller in monetary terms, the Tinder ruling reinforces one of the GDPR's most fundamental guarantees: when individuals request information about themselves from a company, they are entitled to receive everything the organisation possesses, not merely a curated selection.
Source: The Next Web
