A new privacy issue has put TikTok back in the European regulatory limelight. This time, it’s because people are saying that the app used a third-party tracking technology to keep an eye on what other applications were doing, including the LGBTQ+ dating service Grindr. The privacy group None of Your Business, or noyb for short, filed the complaint. It says that TikTok, Grindr, and mobile analytics company AppsFlyer all tracked data across apps in ways that were against the law and may have revealed very private information without the user’s permission.
The case is based on the experience of one person, yet the effects go well beyond that person. Noyb says that this instance shows how unseen data flows between apps can discreetly violate user privacy, even in places with tight rules like the EU’s General Data Protection Regulation. The group made official complaints to Austria’s data protection authorities, asking the government to step in, punish those responsible, and put a halt to the alleged actions.
The claims include that TikTok was able to see what a user was doing on Grindr using AppsFlyer, a business that is often used in mobile marketing to track app installs, user behavior, and ad success. Noyb says that using these kinds of technologies is customary in the digital advertising world, but that it was illegal and unethical to move sensitive information between apps without getting permission first.
The type of data involved in this case makes it more sensitive. Grindr is more than simply a social app; it is directly linked to sexual orientation, which is considered very private information under GDPR. This group is protected by European law since abuse or disclosure can lead to discrimination, stigma, or even bodily injury. Tracking how a user interacts with an app is not the same as keeping an eye on clicks on a shopping site or time spent playing a game.
The user only found out how much surveillance was going on after they made a formal request for access to their data, according to noyb. Even then, the information was not made public right away. The group says that TikTok didn’t give a detailed account of the data it had at first and only did so after they kept asking. Reports say that the data that was accessed included references to the person’s “use of Grindr, LinkedIn” and details about a purchase that was put in an online shopping cart. Privacy activists see this delay in transparency as a big problem in and of itself, since the GDPR says that corporations must clearly and quickly tell people how their data is being used.
Noyb also says that TikTok utilized the information it acquired for things like “personalized advertising, analytics, and security.” This is a familiar term in tech disclosures, but it raises red flags when it comes to data that users may not have agreed to share across platforms. The group says that Grindr and AppsFlyer didn’t have a legal reason to send this information to TikTok in the first place, so using the data later on is just as bad.
The fact that AppsFlyer is said to be involved in the tracking makes things even more complicated. The startup works behind the scenes to connect advertising, app developers, and platforms like TikTok. Most people don’t know what it’s called, yet its software can sit silently inside programs and let you analyze activity in great detail. Critics have long said that this kind of third-party tracking makes it hard to hold people accountable since it spreads responsibility over several companies, making it hard for people to know who is handling their data and why.
The companies who were listed in the complaint did not react right away when asked for comment. This silence raises questions about how each company understands its responsibilities under European privacy law and how they explain the data flows that noyb talks about. In the past, digital companies have often said that data is anonymised or aggregated, but regulators and courts have been more likely to question these assertions, especially when data can be connected back to specific people.
