Everyone has their own secrets. Things he wouldn't easily tell anyone. But maybe he reveals it to the dating app he uses. For example, it tells him the type of partner he wants to find. And the places he likes to visit? He may also reveal to the app his sexual orientation or health condition.
In fact, the app is supposed to use this information to help users find people who share the same interests. On the other hand, it is not in the interest of users for the application to sell their private information to other companies.
But this very thing supposedly happened on Grindr, a dating app explicitly for the LGBT community. So in Britain, about 12,000 people using the Grindr app filed a lawsuit against the app company because it transferred very sensitive personal information about them to advertising clients - and in some cases even revealed their HIV status (AIDS).
This legal dispute ended at the beginning of this week with a settlement totaling £26 million. However, Grinder has denied any responsibility, and there has been no formal admission of guilt - not even a conviction.
This latest case is just the latest in a series of incidents of data leakage and misuse, and it raises a more pressing question: What happens to the personal information we share daily with our applications and digital platforms? Where does the data journey that we voluntarily disclose in exchange for seemingly free services end?
OK, but for what?
Applications are essentially useful tools for users. But behind it is often a complex ecosystem that includes cloud services, analytics tools, advertising networks, and Areen service providers. These entities store, transmit, correlate and analyze our data - which is not always in the best interest of users.
Regarding this, digital policy expert Jean Benferat says that many major technology companies want to “make it as difficult as possible for users and regulatory authorities to understand what data is collected on our devices, who collects it, and for what purpose.” Expert Benferat works as a digital policy advisor for the European Digital Rights Organization (EDRI), a European network of non-governmental organizations and experts to defend fundamental rights and freedoms in the digital space.
And we all know this: an app — like a messaging service — is quickly installed on our devices, and when asked if the app can use our personal data, users often simply click “yes.” Who wants to read long pages about the privacy policy and data protection regulations?
Pictures from private conversations
But the problem lies in the details. For example, during installation, the WhatsApp application accesses the contacts on the smartphone. During this process, the phone numbers of people who do not use WhatsApp and have never agreed to transfer their phone numbers are also transferred to the servers.
Messaging app Discord even collects all text messages, photos, and links sent by its users — even in private chats — as long as they don't already object to the practice by opting out. After years of complaints, at least in May 2026, Discore introduced the feature of encrypting audio and video recordings. There are many such examples.
The larger, more networked, and more complex a company is, the less interested it is in individual data points—and more concerned with patterns. For example, on Google's website: “Google controls many different aspects of our digital lives and has introduced data collection and surveillance at almost every level,” says Benfrat.
Monitor the site and schedule of appointments
“This starts with the devices, that is, when Google itself produces its phones and relies on the Android operating system, each device is equipped with an individual advertising identifier that allows it to be tracked and distinguished throughout its use,” according to Benfarat.
In addition, applications operated by Google itself are often pre-installed on the device. Such as Gmail, address book, contacts and calendar, as well as Google Maps, “where people's whereabouts can be tracked and recorded every minute. And all this data flows into a huge profile.”
Based on this data, companies like Google then provide what is known as “marketing targeting.” “This means that any company that makes cars or clothing can then say, ‘I want to target my ads to this target group, and my ads should be shown in Google Search or in Gmail or on any of the hundreds of millions of partner sites that include Google ads,’” Benfarat says.
"Offer user data files for sale"
Google is just one of many players in this field. “It is a huge global market worth billions of dollars, where user profiles are simply put up and traded for sale,” says Benfrat.
These profiles obtain information from two types of data. First, from the data that each user voluntarily discloses, such as the information he adds to his profile or the photos he uploads. The second type is based on the conclusions and assumptions that technology companies have adopted based on the data they collect, a practice that many major companies have followed for years to form a more detailed picture of users.
“When they have access to my location data and know where I am usually at night, then they can assume that this is my home address,” explains Jan Benferat. “When this address is in a very affluent neighbourhood, they can immediately make assumptions about my salary. When they notice that a user has left geolocation enabled on his device and is a regular at a gay club, then they assume that he is most likely an LGBT person. All this information is added directly to the profile.”
Strict laws in Europe
However, the laws in force in the European Union are among the most stringent data protection laws in the world. The Basic Data Protection Regulation (GDPR) was designed to protect personal data and the privacy of individuals.
Other EU digital laws, such as the Digital Markets Act and the Digital Services Act, also aim to prevent big tech companies from abusing their power over companies and users. US companies must also comply with these laws if they provide services to people in Europe or monitor their behavior.
In fact, the European Commission has imposed repeated fines for violations of its regulations; For example, in 2025, Apple was imposed with a fine of 500 million euros, and another fine of 200 million euros was also imposed on Meta, the parent company that owns Facebook.
Google was also forced this year to pay fines amounting to 890 million euros. This amount may seem huge at first glance, but the picture quickly becomes clear when looking at the net profits of Alphabet, the parent company that owns Google: its net profits in 2025 amounted to the equivalent of about 117 billion euros.
Regarding the size of the fines, Benefrat says: “These are amounts that companies like Google or Amazon earn within a few days. These companies simply deduct these amounts from their budgets.”
Relying on cloud services in the United States of America
Truly effective oversight by the EU is therefore not that easy: the tech giants have global infrastructures, vast financial resources and complex business models. While European authorities must penetrate this potential first.
Added to this is Europe's special reliance on US companies, which still provide - at least for now - most of the cloud services, operating systems, platforms and, increasingly, the AI infrastructure.
This is also why Benferat criticizes the lack of political will in Brussels to take tougher measures against these companies, and to equip European data protection authorities with better tools.
As for what the consumer can do to protect his data, Benfarat points out two basic rules: “First, I should always ask myself: What is the business model that the application adopts? How does it make its profits? Here the golden rule applies: ‘If you do not pay for the service, then you are often the product.’”
On the other hand, we must always look for more trustworthy alternatives, as expert Benferat says: “There are companies that produce smart phones. They produce phones that respect ethical standards and protect users’ privacy and data, while remaining compatible with applications used in daily life. We can use even the social networks that are most sensitive to privacy and data protection.”
“But in the end there is no alternative to the fact that we need tougher laws, that we need more political courage to confront these legal violations committed by so many companies. Because here we have to confront the biggest and most powerful companies that humanity has ever known - and these companies, unfortunately, are not on our side,” says Benfarat.
Prepared by: Raed Al-Bash
Reviewed by: Tariq Ankay
