Ireland's Data Protection Commission today fined MTCH Technology Services Limited €11 million and reprimanded it over Tinder's "Download My Data" tool, which the regulator found had been presented to users as a way to obtain a copy of their personal data while leaving some categories out without notice and reducing others to summaries. The DPC also ordered the company to bring its processing into compliance within three months. The decision closes an own-volition inquiry that the Irish regulator opened in January 2020, and it rests on a single provision of European data protection law: the obligation to hand a person a copy of the personal data a company holds about them.

In Short

Ireland's privacy regulator has fined the company behind Tinder in Europe €11 million because the app's "Download My Data" button gave people an incomplete copy of their personal data while presenting it as their Tinder data. Tens of thousands of users relied on that tool during the period the regulator examined, and the reasoning reaches any business that answers data requests through an automatic export rather than by hand. Self-service tools remain allowed, but the regulator says they must be fair and open about what they leave out, and the company now has three months to fix its processing while Match Group appeals.

What the DPC decided

The announcement, dated November 13, 2026, describes a final decision in an inquiry the DPC launched on its own initiative rather than in response to a single complaint. The regulator acted "in its role as the Lead Supervisory Authority for MTCH," according to the DPC, the position the one-stop-shop mechanism gives to the authority in the member state where a company processing data across Europe has its main establishment. Reuters, in a syndicated report, described MTCH Technology Services Limited as the Irish unit of Match Group, the US company that owns Tinder.

The legal finding is narrow. "This decision concerns MTCH's failure to provide Tinder users with a complete copy of their personal data on request, pursuant to Article 15(3) GDPR," according to the DPC. That paragraph of the GDPR requires a controller to provide a copy of the personal data it is processing, and where a person asks electronically, to supply it in a commonly used electronic form unless the person requests otherwise. It sits inside the wider right of access, which also entitles people to know why their data is processed, who receives it and where it came from.

Three sanctions follow from the finding:

  • a reprimand;
  • an administrative fine of €11 million;
  • an order requiring MTCH to bring its processing into compliance within three months.

The decision was made by all three Commissioners for Data Protection: Dr Des Hogan, Dale Sunderland and Niamh Sweeney. Hogan and Sunderland were appointed in February 2024. Sweeney, a former Meta executive, was named as the third commissioner on September 17, 2025, and her five-year term began on October 13, 2025. None of the three held a commissioner's post when the inquiry began.

The DPC did not publish the decision itself. "The DPC will publish its full decision in due course," according to the announcement, which does not set a date.

A tool that promised a copy

At the centre of the case is a self-service feature, which the DPC calls the Download My Data tool, that allowed Tinder users to download their data without writing to the company. The regulator did not object to the existence of such a tool. Its objection was to the gap between what the tool appeared to offer and what it delivered.

"Although this tool was presented to users as a way to obtain a copy of their Tinder data, the DPC found that it failed to provide users with all of their personal data," according to the DPC. Two failures are described. "Certain categories of information were omitted without notice to the user, or provided in summary form only," according to the regulator. And the data the tool did provide "did not meet the requirements of the right of access under the GDPR."

Which categories were left out is not stated. Nor is the period the inquiry examined, the format of the export, or whether the omitted information was available to users by some other route. Graham Doyle, the DPC's Deputy Commissioner, put a rough size on the problem in the only quantitative statement the announcement contains.

"The Download My Data tool was presented to Tinder users as a way to request a copy of their personal data. Tens of thousands of users used the Download My Data tool during the period of time assessed by this Inquiry," Doyle said.

The figure is approximate, but it measures something specific: people who asked for their data, used the channel offered to them, and received less than they were led to expect.

Partial is permitted; silent is not

The announcement contains a tension worth reading closely. The DPC's own summary frames the infringement as a "failure to provide Tinder users with a complete copy" of their data. Doyle's statement then says completeness is not, in itself, what the regulator demands of automated tools.

"Such automated access tools can be a useful and efficient way to provide access to personal data and supporting individuals in exercising their GDPR rights. These tools do not need to provide a complete copy of personal data but they must be fair and transparent to individuals regarding the extent of the data provided," Doyle said.

Read together, the two statements point in one direction. A self-service export may cover part of what a company holds, and the company can deal with the rest some other way, but the tool cannot imply it is the whole answer when it is not. At Tinder, according to the DPC, the tool was presented as the way to obtain a copy of a user's data, and the omissions were made "without notice to the user." The breach of Article 15(3) appears to sit in that silence, since a user who believed the download was complete had no reason to ask for anything more. That reading is PPC Land's; the full decision will show how the commissioners reasoned, and whether they treated summary-only categories as a separate failure.

Courts have been moving the same way. The Austrian Supreme Court ruled on November 26, 2025, in case 6 Ob 189/24y that Meta had to give one user all the personal data it had collected about him, with the source, recipient and processing purpose of each data point, within 14 days. PPC Land's coverage of that judgment reported that Meta could not rely on its generic privacy policy or a limited download tool to answer the request. The Irish decision is administrative rather than judicial and concerns a different company, but both treat a platform's built-in export as a starting point for the right of access, not a substitute for it.

Nearly seven years from inquiry to fine

The inquiry was not always this narrow. TechCrunch reported on February 4, 2020 that the DPC had announced a formal probe of how Tinder processed users' personal data, the transparency surrounding that processing, and the company's compliance with obligations on data subject rights requests. The DPC's statement at the time, as carried by TechCrunch, said the inquiry would seek to establish whether the company had a legal basis for its ongoing processing, and whether it met its obligations as data controller on transparency and on requests from users exercising their rights. According to that report, the DPC had acted after monitoring complaints from Ireland and other EU countries, and some users had accused the company of not providing a copy of all their data. Match Group told TechCrunch at the time that it was cooperating fully with the regulator.

Today's announcement addresses only the last of those strands. It says nothing about legal basis or about the transparency of Tinder's processing in general, and it does not say whether those questions were resolved, dropped or folded into the access finding. The full decision may answer that.

By PPC Land's calculation, today's decision comes 2,474 days after the inquiry became public on February 4, 2020, and more than six years and nine months after its launch in January of that year. The DPC's announcement does not explain the duration. Long gaps between inquiry and outcome are not unusual for the Irish regulator: its €403 million fine on Google, announced on September 21, 2026, came 2,951 days after the DPC first questioned Google about location data and asked for an urgent response.

Cases led by the DPC under the one-stop-shop also pass through other regulators. Before a lead authority adopts a decision in a cross-border case, it must share a draft with the other authorities concerned, which can object. Doyle's statement closed with thanks to those peers: "The DPC would also like to thank its peer supervisory authorities for their cooperation and assistance in this case." The announcement does not say which authorities were involved, or whether any objection was raised.

Match Group says it will appeal

Match Group said it had received the decision and decided to appeal, according to statements reported by the Irish Examiner and NewsIreland.EU. The company also said that Tinder had engaged with the DPC throughout the investigation and that it stood behind the privacy protections it had built for users, according to the Irish Examiner and, citing a statement given to Politico, The Next Web.

The Next Web also reported, citing Match Group's filings, that the company had told investors the case could cost it as much as $60 million and had set aside a provision of $9.1 million by mid-2026. Those figures come from that outlet's reporting; the DPC's announcement contains no financial information about the company beyond the fine.

An appeal would add Tinder to a long list of DPC decisions still in the courts. An analysis covered by PPC Land in May found that Ireland accounts for €4.04 billion of the €7.1 billion in GDPR fines announced since May 2018, roughly 66 percent of the total, and that about 40 percent of all announced GDPR fine value had been annulled or remained under challenge.

Where €11 million sits

Infringements of the data subject rights in Articles 12 to 22 of the GDPR fall into the higher of the regulation's two fine tiers, with a maximum of €20 million or 4 percent of a company's total worldwide annual turnover in the preceding financial year, whichever is higher. The €11 million penalty is well inside that range.

Measured against the DPC's other recent decisions, it is modest. The regulator fined LinkedIn €310 million on October 24, 2024, TikTok €530 million in May 2025 over data transfers to China, and Google €403 million in September. A separate DPC inquiry triggered by an access request is still pending: the academic Michael Veale asked Meta on May 25, 2018 for full access to his personal data stored in Facebook's internal "Hive" data warehouse, and the Irish High Court dismissed Meta's challenge to that inquiry on May 21, 2026, clearing the way for a proposed fine of between €360 million and €430 million.

Measured against other fines for access failures, €11 million is substantial. The Dutch Data Protection Authority's €10 million fine on Uber, reported by PPC Land on February 1, 2024, found that the company had made it unnecessarily difficult for drivers to request access to their data, with the request form buried deep in the app and data provided in an unclear format. Belgium's data protection authority fined a telecom company €100,000 in a decision dated August 23, 2024 for taking more than 14 months to answer one access request. On data rights requests more broadly, France's CNIL fined EXTIA 300,000 euros in a decision taken on July 21, 2026 for mishandling erasure requests, a breach of GDPR Articles 12 and 17.

The Uber case is the closest parallel. Both involve a consumer platform whose built-in route to personal data fell short of the law. The Dutch case turned on how hard the route was to find and how unclear its output was; the Irish case turns on what the route left out without saying so.

A company regulators know

Match Group is also familiar to regulators on the other side of the Atlantic. Match Group agreed to pay $14 million to settle Federal Trade Commission charges in a settlement announced on August 12, 2025, ending a case filed on September 25, 2019 over what the FTC called deceptive practices on Match.com. On March 30, 2026, the FTC filed a complaint and proposed settlement alleging that OkCupid gave a facial recognition company access to about three million user photos; the complaint identifies Match Group as the ultimate parent of OkCupid's operator, Humor Rainbow, and dates the transfer to September 2014.

Those US cases concerned subscriptions and data sharing. The Irish case concerns something more basic: whether a user who asks what the company holds gets a straight answer.

Why access requests matter to the advertising industry

The right of access is one of the few tools individuals have to see what platforms and ad tech systems actually record about them. Requests have brought to light internal data stores and internal notes that privacy notices never mention. Veale's 2018 request to Meta targeted its internal data warehouse. A European talent acquisition professional used a GDPR access request to learn why a hiring process ended in rejection after a panel had voted in her favour, according to PPC Land's report in April 2026. When the copy is incomplete and says nothing about the gaps, that visibility disappears.

The DPC's test, as stated by Doyle, is simple to describe and harder to engineer: automated tools "must be fair and transparent to individuals regarding the extent of the data provided." For any company that answers access requests through an export button rather than by hand, the question the decision raises is whether the export says what it does not contain. That applies to consumer apps, to advertising and analytics companies that act as controllers in their own right, and to brands, whose customer records, audience lists and event logs are personal data under the same law.

Dating services carry particular sensitivity. Profiles, messages, preferences and location can reveal sexual orientation and other information the GDPR treats with extra protection, and users appear increasingly wary. Verve's 2025 In-App User Privacy Report, released on February 13, 2026, found that dating app users' willingness to share their names had fallen by 3.6 percentage points compared with 2024.

What the announcement leaves open

Several questions will only be answered when the DPC publishes the full decision, or not at all:

  • Omitted categories. The DPC does not say which categories of personal data the tool left out, which it reduced to summaries, or why.
  • The period assessed. The inquiry covered "the period of time assessed by this Inquiry," which the announcement does not define. It does not say whether the tool still works the same way today.
  • The other strands. The 2020 inquiry, as reported at the time, also covered legal basis and transparency. Today's decision addresses neither.
  • The three-month clock. The order gives MTCH three months to comply, but the announcement does not say when the period starts. If it runs from today, the deadline would fall on February 13, 2027 - a PPC Land calculation, not a date the DPC has given. Whether an appeal affects the order is also not addressed.
  • Peer authorities. Which supervisory authorities took part, and whether any objected to the DPC's draft, is not stated.
  • Affected users. The announcement gives no figure beyond "tens of thousands," and it does not say whether users who received incomplete copies will be contacted or offered the missing data.

Timeline

Summary

Who: Ireland's Data Protection Commission, acting as lead supervisory authority, and MTCH Technology Services Limited, the Match Group company whose Tinder service was examined. The decision was made by Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney; Deputy Commissioner Graham Doyle commented on it. Match Group said it would appeal.

What: An €11 million fine, a reprimand and an order to bring processing into compliance within three months, after the DPC found that Tinder's Download My Data tool, presented as a way to obtain a copy of personal data, omitted some categories without notice and gave others only in summary form, in breach of Article 15(3) of the GDPR. Tens of thousands of users used the tool during the period assessed.

When: The DPC announced the decision today, November 13, 2026, closing an own-volition inquiry launched in January 2020 and made public on February 4, 2020. The full decision has not been published.

Where: Ireland, with the decision applying to Tinder users across the European Union through the GDPR's one-stop-shop and with cooperation from other European supervisory authorities.

Why: The right of access only works if the copy a company provides is complete or says clearly what it leaves out. The DPC's position is that automated download tools are legitimate but must be fair and transparent about their limits, a test that reaches every company answering data requests through a self-service export.