TikTok, Grindr, and AppsFlyer Face GDPR Complaints Over Sensitive Data sharing
TikTok’s data collection practices are under intense scrutiny, wiht new complaints filed in Austria alleging widespread violations of the general Data Protection Regulation (GDPR). These concerns aren’t isolated to TikTok itself, but extend to its partners – Grindr and data intermediary AppsFlyer – raising serious questions about the security and privacy of user data.
This isn’t simply about tiktok gathering information within its app. The allegations detail a concerning pattern of acquiring data from other sources, building a remarkably complete profile of users’ online lives. A recent case brought to light reveals how sensitive information,including a user’s sexual orientation and intimate details gleaned from Grindr,ended up in TikTok’s possession.
How Did This Happen? The Role of AppsFlyer
The data transfer wasn’t direct. AppsFlyer, an Israeli data company, appears to have acted as a crucial link. Its alleged that AppsFlyer received sensitive data from Grindr and subsequently passed it on to TikTok.
this raises a fundamental legal issue: neither AppsFlyer nor Grindr possessed a valid legal basis, as required by article 6(1) GDPR, to share this personal data with a third party like TikTok. Furthermore, sharing sensitive data – like information revealing sexual orientation – without explicit consent violates Article 9(1) GDPR.Crucially, the user in question never consented to this data sharing.
TikTok’s Obstruction of Data Access Requests
GDPR grants users the right to know what data a company holds about them and to receive a copy of that data. However, TikTok is accused of systematically obstructing this right.
Instead of providing a complete data set, TikTok directs users to a “download tool.” However, the company has admitted this tool only contains data TikTok deems “relevant,” a far cry from the full picture required by law. Repeated requests for the complete data have been met with silence, leaving users in the dark about how their information is being used. This directly contravenes Articles 12 and 15 GDPR, which mandate full and easily understandable data provision.
“TikTok directs its users to an inherently incomplete ‘download tool’,” explains Lisa Steinfeld, a data protection lawyer at noyb (European Center for Digital Rights). “It’s fair to assume that thousands of users were sent to this scam tool, which structurally doesn’t comply with the legal requirements to provide a full copy of one’s own personal data.”
Complaints Filed with the Austrian Data Protection Authority
noyb has filed two formal complaints with the Austrian Data Protection Authority (DSB).
* Complaint 1 (TikTok): Focuses on the incomplete response to the user’s data access request.
* Complaint 2 (TikTok, AppsFlyer, Grindr): Addresses the unlawful processing of off-TikTok data, the lack of a legal basis for data sharing, and the violation of Article 9(1) GDPR regarding sensitive data.
noyb is demanding that TikTok provide the missing data to the complainant and that all three companies cease the unlawful processing of personal data.The complaints also request the DSB impose a significant fine – “effective, proportionate and dissuasive” as outlined in Article 83 GDPR – to deter future violations.
What This Means for Users:
This case highlights the complex web of data sharing that exists behind the scenes of many popular apps. It underscores the importance of:
* Understanding app privacy policies: While often lengthy and complex, these policies outline how yoru data is collected and used.
* Exercising your GDPR rights: You have the right to access, rectify, and erase your personal data.
* Being mindful of data sharing: Consider the potential implications of linking accounts or sharing data between different apps.
This situation is a stark reminder that protecting your digital privacy requires vigilance and a clear understanding of your rights. The outcome of these complaints will likely set a precedent for data protection enforcement in the EU and beyond.
Keep reading