Tinder's €11M DPC Fine: A Self-Service Data Download Must Say What It Leaves Out

Table of contents

The DPC Decision
A Partial Download Is Allowed, a Silent One Is Not
Checking Your Own Tool
Preference Centres Have the Same Gap
Data Requests in UniConsent
References

Table of contents

The DPC Decision
A Partial Download Is Allowed, a Silent One Is Not
Checking Your Own Tool
Preference Centres Have the Same Gap
Data Requests in UniConsent
References

If your website or app lets people download their own data, or shows it to them in a privacy portal or preference centre, check what that tool leaves out. On November 13, 2026, Ireland's Data Protection Commission (DPC) announced an €11 million fine against MTCH Technology Services Limited, the Match Group company behind Tinder. Tinder's "Download My Data" tool gave users only part of their personal data and did not tell them so.

Tinder's €11M DPC Fine: A Self-Service Data Download Must Say What It Leaves Out

The DPC Decision

The DPC opened the inquiry on its own initiative in January 2020, as lead supervisory authority for MTCH in the EU. It looked at how Tinder answered users who asked for a copy of their data.

Tinder handled those requests through an automated tool called "Download My Data". The DPC found that the tool "failed to provide users with all of their personal data. Certain categories of information were omitted without notice to the user, or provided in summary form only." That breached Article 15(3) of the GDPR, which gives a person the right to a copy of the personal data a company processes about them.

The DPC's announcement does not list the missing categories. RTÉ, reporting comments from Commissioner Niamh Sweeney, said some activity was returned as daily totals, such as the number of swipes or matches on a given day, and that analytics data that could include gender and location was not included.

The decision has three parts:

A reprimand
A fine of €11 million
An order to bring the processing into compliance within three months

Match Group says it will appeal, and that Tinder "engaged with the DPC throughout this investigation". The DPC will publish the full decision later.

A Partial Download Is Allowed, a Silent One Is Not

The DPC did not say that a self-service tool has to return everything. Deputy Commissioner Graham Doyle said automated access tools "can be a useful and efficient way to provide access to personal data", and added:

These tools do not need to provide a complete copy of personal data but they must be fair and transparent to individuals regarding the extent of the data provided.

Tinder's users had no way to know that the file was incomplete. Someone who downloads their data and sees no location history will assume none is held. They will not make a second request for data they do not know exists, so the right of access stops at whatever the tool was built to export.

This matches the EDPB's guidelines on the right of access. A self-service tool is an accepted way to answer a request, and when there is a lot of data a company can provide it in layers, as long as the person can get every layer if they ask.

According to the DPC, tens of thousands of users used the tool during the period it examined.

Checking Your Own Tool

The same test applies to any tool that shows people their own data: an account export, a "my data" page, a privacy portal or a preference centre.

List every system that holds personal data

An export is usually built from the main product database. Analytics events, ad platform audiences, support tickets, CRM notes, consent records and inferred attributes such as segments or scores sit elsewhere and get left out. Compare the export against your record of processing activities, not against the database it was built from.

Say what the download covers

If the tool returns only part of the data, say so on the screen where the person starts the download and inside the file itself. Name the categories that are not included.

Give a route to the rest

Next to the download, link to a request form for a full copy. A person who asks through that form is making a normal data subject access request, and the one-month deadline applies.

Do not replace data with summaries

Tinder returned some data only in summary form. A count of events is not a copy of the events. If you hold the detailed records, the person is entitled to them.

Review the tool when the product changes

A new feature, SDK or analytics tool often means a new category of personal data. Add the export to your release checklist so it does not fall behind the product.

Preference Centres Have the Same Gap

A preference centre makes a similar promise: this is what you have agreed to. If it shows the newsletter choice but not SMS consent, the cookie choices made in the banner or the personalisation setting in the app, the person sees a partial picture and has no reason to doubt it.

The fix is the same. Either show every consent you rely on, or say which ones are managed elsewhere and link to them.

Data Requests in UniConsent

The UniConsent Privacy Portal gives your users one page, on your own domain, to manage their consent and marketing preferences and to submit requests for access, deletion, correction and portability. Each request is tracked against its legal deadline, and every step is logged with a timestamp.

You can put the request form next to your own download tool, so a user who needs more than the tool provides has a clear way to ask for it.

Consent choices from the cookie banner, your forms and your apps are stored together with their history, so the consent part of an access response is complete. See the consent audit trail.

For other recent decisions, see the GDPR enforcement fines overview for 2026.