--- title: "Tinder fined €11m: its ‘Download My Data’ tool left data out" summary: "Ireland’s Data Protection Commission’s decision of 13 November: what Tinder’s data-download tool got wrong, what Article 15 of the GDPR entitles a user to, and an inquiry opened in 2020." url: https://www.thetechbag.com/blog/tinder-fined-11m-euros-download-my-data format: Note desk: "Data & privacy" region: Global published: 2026-11-14 facts_checked: 2026-11-14 author: TechBag (The TechBag Journal) tags: ["Tinder fine","Tinder GDPR fine","DPC fine","Tinder Download My Data","MTCH Technology Services","Data Protection Commission","Ireland","GDPR Article 15","right of access","subject access request","copy of personal data","data export","reprimand","GDPR","dating apps"] cover: https://www.thetechbag.com/blog/covers/tinder-fined-11m-euros-download-my-data.png --- # Tinder fined €11m: its ‘Download My Data’ tool left data out *Ireland’s Data Protection Commission’s decision of 13 November: what Tinder’s data-download tool got wrong, what Article 15 of the GDPR entitles a user to, and an inquiry opened in 2020.* Note · Data & privacy · By TechBag · Published 2026-11-14 · Facts checked 2026-11-14 · Canonical: https://www.thetechbag.com/blog/tinder-fined-11m-euros-download-my-data Ireland’s Data Protection Commission has fined MTCH Technology Services Limited, the company that runs Tinder in the EU, €11m and reprimanded it, because the app’s “Download My Data” tool did not give users a complete copy of their personal data. Some categories of information were left out without telling the user; others came only in summary form.[1] The commission announced the decision on 13 November and ordered MTCH to bring its processing into line with the GDPR within three months. The inquiry behind it was opened in January 2020.[1] €11m fine, with a reprimand, on Tinder’s EU operator DPC Jan 2020 when the DPC opened the inquiry on its own initiative DPC 3 months to bring its processing into compliance DPC 15(3) the GDPR article on a copy of your data that the tool fell short of DPC ## What the tool did wrong The decision is about the right of access under Article 15(3) of the GDPR: a person who asks is entitled to a copy of the personal data a company holds on them. Tinder offered a self-service tool for that. The commission found that although the tool was presented as the way to get a copy of one’s Tinder data, it did not provide all of it, and what it did provide did not meet the requirements of the right of access.[1] Deputy Commissioner Graham Doyle said “tens of thousands” of users used the tool during the period the inquiry assessed.[1] > These tools do not need to provide a complete copy of personal data but they must be fair and transparent to individuals regarding the extent of the data provided.Graham Doyle, Deputy Commissioner, Data Protection Commission, 13 November 2026 That is the point of the case: an export button may hand over less than everything, if it says so and tells the user how to get the rest. Tinder’s left categories out silently. The commission has not yet published the full decision, so which categories were missing is not public.[1] The case started from complaints. On 4 February 2020 the commission said it had seen issues raised by people in Ireland and across the EU and would examine MTCH’s legal basis for processing, its transparency and how it handled requests from users exercising their rights.[2] Its 2024 annual report described the inquiry as covering both access requests and erasure requests (Article 17), with MTCH replying to a preliminary draft decision that year.[3] The 13 November announcement names only the access finding. As MTCH’s lead authority in the EU, the Irish commission decided the case with the cooperation of its peer regulators.[1] ## What Article 15 entitles you to Under the GDPR, anyone can ask a company whether it holds personal data about them. If it does, they are entitled to: - **A copy of the data itself,** the first one free; a reasonable fee is allowed only for further copies. A request made electronically gets an answer in a commonly used electronic form.[4] - **The facts around it:** why the data is processed, which categories are held, who it has been or will be shared with, how long it will be kept, where it came from if not from the person, and whether automated decisions or profiling are used, with meaningful information about the logic involved.[4] - **An answer within one month,** which the company may extend by two further months for complex or numerous requests, if it says so within the first month.[4] The one limit in the article is that a copy must not adversely affect the rights and freedoms of others, such as another person’s messages.[4] Our viewIf your product has an export button List what the export includes and what it leaves out, on the page where users download it, and give them a route to request the rest. The Irish decision fines the silence, not the tool. Europe is also writing new rules for how apps present choices to users: see [our Analysis of the Digital Fairness Act proposal](https://www.thetechbag.com/blog/eu-digital-fairness-act-dark-patterns-6-percent-fines). How we did this Figures as of 14 November 2026, 7:30pm IST The decision, the fine, the reprimand, the three-month order and the quotation are from the Data Protection Commission’s release of 13 November; the commission says it will publish the full decision later, so we do not name the categories of data the tool left out. “Tens of thousands” is the commission’s own figure. The inquiry’s start is as the commission gives it, January 2020; it announced the inquiry on 4 February 2020. The scope described in its 2024 annual report (access and erasure) is from page 50 of that report. What Article 15 entitles a person to is from the text of the GDPR, Articles 12(3), 12(5) and 15, in plain words. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Data Protection Commission, Data Protection Commission fines MTCH €11 million following Inquiry into Tinder users’ personal data requests](https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-mtch-eu11-million-following-inquiry-tinder-users-personal-data) — 13 November 2026 2. [Data Protection Commission, Data Protection Commission launches Statutory Inquiry into MTCH Technology Services Limited (Tinder)](https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-launches-statutory-inquiry-mtch-technology) — 4 February 2020 3. [Data Protection Commission, Annual Report 2024, Decisions and Inquiries (p. 50)](https://www.dataprotection.ie/sites/default/files/uploads/2025-06/DPC_Annual_Report_EN_Low_Res.pdf) — June 2025 4. [Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 12 and 15](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) — 27 April 2016 **Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [EU proposes Digital Fairness Act: 10 dark patterns banned, fines up to 6% of turnover](https://www.thetechbag.com/blog/eu-digital-fairness-act-dark-patterns-6-percent-fines) — Europe’s next rules for how apps treat users: the 11 November proposal bans 10 dark patterns, with fines up to 6% of worldwide turnover. Go deeper on TechBag - [Data security posture management guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — tools that find where a person’s data sits, the first step in answering an access request - [Data security and privacy guides](https://www.thetechbag.com/browse/data-security-privacy) — every TechBag guide on protecting and governing personal data