The complaints were submitted on Wednesday to Austria’s data protection authority by Vienna-based organisation None of Your Business (noyb). The group claims the companies breached the EU’s General Data Protection Regulation (GDPR) by tracking users across multiple apps without valid consent, potentially exposing highly sensitive personal information.
According to noyb, the case centres on an individual whose data was allegedly shared between apps without their knowledge. The organisation said TikTok tracked the user’s activity on Grindr through AppsFlyer, a mobile marketing and analytics company, raising concerns about cross-app surveillance and unlawful data transfers.
noyb said the user uncovered the alleged tracking through a data-access request, which revealed that TikTok had obtained information about the person’s use of several apps, including Grindr and LinkedIn, as well as details about a product added to an online shopping cart. The group claimed TikTok only disclosed this information after repeated enquiries, which it said amounted to a failure to meet GDPR transparency requirements.
In its complaint, noyb argued that neither Grindr nor AppsFlyer had a legal basis to share the user’s data with TikTok. It further alleged that AppsFlyer facilitated unauthorised data transfers, while TikTok and Grindr shared sensitive information illegally.
The group said TikTok indicated that the data was used for purposes including personalised advertising, analytics and security. However, noyb stressed that GDPR affords special protection to sensitive data such as sexual orientation, warning that misuse of such information could lead to discrimination.
noyb has called on Austrian regulators to investigate the matter, impose fines where appropriate and order the companies to halt the alleged practices.
The case adds to growing regulatory and legal scrutiny facing the companies involved. In May, Ireland fined TikTok €530 million over concerns related to data transfers to China. Grindr is also facing a mass lawsuit in London from users who allege that their HIV status was shared with third parties without consent between 2018 and 2020.
Representatives of TikTok, Grindr and AppsFlyer were not immediately available for comment at the time of filing.