noyb files complaints over TikTok’s off-app tracking and refusal to disclose users’ full personal data
Digital rights group noyb has filed two complaints with Austria’s data protection authority, alleging that TikTok unlawfully tracks people across other apps – including dating platforms – and fails to provide users with a complete copy of the personal data it holds.
noyb has filed two formal complaints against TikTok and its data-sharing partners AppsFlyer and Grindr, alleging unlawful off-app tracking and systemic failures to comply with European data access rights. The organisation says the case highlights how TikTok’s data-collection practices extend far beyond its own platform, raising serious questions about transparency, consent and the handling of sensitive data.
The complaints follow a user’s access request under the General Data Protection Regulation (GDPR), which revealed that TikTok received detailed information about his behaviour in other apps – including the gay dating app Grindr. According to the documents, this data was routed via the Israeli analytics company AppsFlyer and allowed TikTok to infer intimate details such as sexual orientation and aspects of the user’s sex life. Under Article 9 of the GDPR, such sensitive information can only be processed in strictly limited circumstances.
noyb argues that neither AppsFlyer nor Grindr had a lawful basis to share this data with TikTok. The user did not consent to off-app tracking and no alternative legal grounds under Article 6 of the GDPR appear applicable. The organisation describes the sharing as ‘accomplice’ behaviour, enabling TikTok to build a broader picture of individuals’ online activity.
Alongside the off-app tracking concerns, noyb has also challenged TikTok’s handling of data access requests. The company directs users to a downloadable archive that it describes as containing their personal data. According to noyb, TikTok later admitted that the tool only includes a subset of what it calls the most “relevant” information, omitting other categories of data processed about users. Even after repeated follow-up requests, the complainant was not provided with a full explanation of what data TikTok holds or how it is used.
noyb argues this practice violates Articles 12 and 15 of the GDPR, which require companies to provide complete, comprehensible access to personal data and to disclose all recipients of that data. The organisation believes the incomplete download tool may have misled thousands of users seeking full access to their information.
Both complaints have been filed with the Austrian data protection authority. The first concerns TikTok’s incomplete response to the access request. The second targets TikTok, AppsFlyer and Grindr over the off-app data flows, alleged absence of a lawful basis for processing and the handling of special-category data. noyb is asking regulators to order the companies to cease the disputed practices, provide the missing information and consider imposing a dissuasive fine under Article 83 of the GDPR.
