TikTok accused of illegally tracking user's Grindr activity

Advocacy group calls for financial punishment

A European privacy advocacy group has accused TikTok of illegally tracking a user's activity on the LGBTQ+ dating app Grindr and other apps, alleging serious breaches of European data protection law and the unlawful handling of highly sensitive personal data.

The Vienna-based digital rights organisation None of Your Business (noyb) said it has filed complaints with Austria's data protection regulator against TikTok, Grindr and the Israeli mobile analytics firm AppsFlyer.

The group claims the companies shared personal data without a valid legal basis, potentially exposing information about sexual orientation and sex life.

According to noyb, TikTok, which is owned by China's ByteDance, acknowledged under pressure that it tracked a complainant's activity on Grindr as well as on other apps.

The organisation said TikTok was also able to see which items the user added to a shopping cart on an app unrelated to Grindr.

Under the EU's GDPR, data relating to sexual orientation is classified as sensitive and is subject to special protections.

Noyb said the complainant never explicitly consented to TikTok processing data about his activity beyond the platform, a requirement under European law.

The complainant also said he repeatedly asked TikTok to explain how his personal data was being used.

Companies are required under GDPR to provide such information, but noyb alleges TikTok responded on multiple occasions with information that was incomplete and difficult to understand.

Two complaints relating to these alleged transparency failures were filed on 9th December, the organisation said.

Noyb claims the unauthorised data sharing was "likely" facilitated by AppsFlyer, a company that provides mobile marketing analytics services.

One of the complaints names AppsFlyer and Grindr alongside TikTok as joint subjects of the alleged violations.

TikTok has said the data was used for purposes including "personalised advertising, analytics, [and] security", according to noyb.

However, the group argues that both Grindr and AppsFlyer lacked a valid legal basis under Article 6(1) of the GDPR to share the complainant's personal data with third parties, including TikTok.

"At no point in time did the complainant consent to the sharing of his data," noyb said in a statement, calling on Austrian regulators to impose fines and order the companies to stop the alleged practices.

Kleanthi Sardeli, a data protection lawyer at noyb, said: "Like many of its US counterparts, TikTok increasingly collects data from other apps and sources. This allows the Chinese app to gain a full picture of people's online activity.

“The fact that data from another app revealed this user's sexual orientation and sex life is just one of the more extreme examples."

The latest complaints add to ongoing scrutiny of TikTok's data practices.

In 2022, ByteDance admitted that some TikTok employees had inappropriately accessed user data, including data belonging to two Western journalists.

Noyb has previously achieved significant legal successes.

Its complaints have led European regulators to fine several major technology companies in recent years, including Meta, Google, Spotify, Netflix and Grindr.

In 2023, Meta was fined €1.2b (£1.05b) and ordered to stop transferring Europeans' personal data to the US following a noyb complaint.

In May, Irish regulators fined TikTok €530m (£455m) over the transfer of European users' data to China and failures to meet GDPR transparency requirements.

Grindr is also facing separate legal action. The company is currently the subject of a mass lawsuit in London brought by users who allege their HIV status was shared with third parties without consent between 2018 and 2020.