NOYB files 2 GDPR complaints against TikTok over illegal cross-app tracking

Austrian privacy advocacy group NOYB has filed two complaints with the Austrian data protection authority (DPA) against TikTok and its data-sharing partners, AppsFlyer and Grindr, over alleged unlawful cross-app tracking of users. A user discovered that his data from the Grindr app had been sent to TikTok, presumably, according to NOYB, via AppsFlyer, raising concerns over the collection of special category data, including sexual orientation. Initially, TikTok withheld this information from the user, but after repeated requests, the company acknowledged that it had access to detailed data about the user's activities across various apps. NOYB argues that neither AppsFlyer nor Grindr had a legitimate lawful basis under the EU General Data Protection Regulation (GDPR) for sharing this personal data without the user's consent. NOYB claims that TikTok fails to adequately inform users about their data rights and does not provide complete access to individual data through its download tool. 

The first complaint focuses on TikTok's incomplete response to a subject access request (SAR) under Articles 12 and 15. The second complaint addresses the indiscriminate processing of off-TikTok activity under Article 5(1)(c), processing of data without a valid legal basis under Article 6(1), and the processing of data relating to the complainant's sex life and sexual orientation without obtaining explicit consent under Article 9(1).

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.