Irish regulator fines Tinder €11 million for violating user data access rights

The Irish Data Protection Commission fined Tinder €11 million on November 14, 2026, for violating the EU General Data Protection Regulation (GDPR). The investigation, which began in 2020, focused on how the dating application handles user requests for personal information. The regulator found that the company, owned by MTCH Technology Services Limited, failed to provide complete copies of personal data to its customers through its automated tools.

The nature of the data violations

The investigation centered on the "Download My Data" tool, a feature designed to allow customers to request and receive their personal information. According to the Irish Data Protection Commission, the tool failed to provide complete copies of personal data because it excluded certain categories of information without notifying the users. Furthermore, some of the data provided to users through this tool was only available in a summarized format rather than a full record.

The scale of the issue is significant, as tens of thousands of users utilized the "Download My Data" tool during the period analyzed by officials. The regulator determined that these failures prevented users from exercising their full rights under the GDPR regarding access to their personal data.

Regulatory oversight and compliance

The Irish Data Protection Commission serves as one of the primary regulators for the sector within the European Union. Graham Doyle, the Deputy Commissioner of the Irish Data Protection Commission, commented on the findings regarding automated systems. Graham Doyle stated that "Automated tools can facilitate the exercise of GDPR rights and help organizations manage access requests efficiently, but users must be transparently and fairly informed about the scope of information provided."

The ruling requires immediate changes to how the platform manages user information. Tinder must adjust its data processing operations to comply with EU regulations within a three-month deadline. This period allows the company to rectify the technical shortcomings in its data export tools to ensure transparency and completeness for all users.

What happens next

The fine marks a significant enforcement action regarding how major technology companies manage automated data requests. Following the decision, MTCH Technology Services Limited must ensure that its data retrieval processes meet the strict standards set by the European Union. The three-month deadline ensures that the technical infrastructure of the application is updated to provide full, unsummarized datasets to any user requesting their information through the "Download My Data" tool.

Glossary

• Irish Data Protection Commission — The Irish Data Protection Commission is a regulator for the sector within the European Union. It serves as one of the primary regulators for the sector.
• data processing operations — Data processing operations refer to the ways in which a company manages and handles user information. In the context of compliance, these operations must be adjusted to meet specific regulations.
• automated tools — Automated tools are systems that can facilitate the exercise of GDPR rights and help organizations manage access requests efficiently. They can also be used to provide personal information to customers.