The GDPR requests that move a dating app ban - access first, erasure last

Every other route on this site asks the platform to change its mind. The privacy routes are different: they work on the file rather than the decision. That is genuinely powerful, and it is also where most advice about dating app bans goes wrong, because it reaches for the wrong one of the two.

There are two requests, and they do opposite things. An access request (GDPR Article 15, or its Californian and US state cousins) forces the company to hand over the personal data it holds about you. An erasure request (Article 17) asks the company to delete it. Advice columns love the second one, because deletion sounds like a cheat code: no record, no ban. It is not, and the next two sections set out exactly why, using the platforms’ own published retention periods.

The order that works is the other way round. Access first, because seeing the file is what makes every other route sharper and is the request with documented reinstatements behind it. Erasure last, if ever, because it is the one move that can destroy your own case. This guide covers the mechanism in plain English, what the platforms actually hold and for how long, both copy-paste letters, the clocks in Europe and the United States, the regulator complaint that follows an ignored access request, the routes to run in parallel while you wait, and the honest limits of all of it.

Access first: the privacy route with reinstatements on the record

Understand what each rung of the ladder actually aims at, and the sequencing stops looking like paperwork and starts looking like strategy. A platform appeal asks a moderator to re-read a decision. The Match Group escalation desk asks a second human to look at the same file. A DSA Article 21 dispute asks a certified outside body to audit the process that produced the decision. A BBB complaint puts your version and theirs on a public record for three years. An access request does something none of them do: it makes the company show you what it holds.

That is the request with reinstatements behind it. The Irish Data Protection Commission - the lead regulator for the European Match Group entity - publishes case studies of complaints it has handled. Among them are banned Tinder users whose access requests had gone unanswered. They complained to their own data protection authority, the matter reached the DPC, and after the DPC’s correspondence the company, in the regulator’s words, conducted a fresh review of the account and reinstated it. Read that mechanism carefully, because the detail is the point: nobody ordered a reinstatement. A regulator asked about an ignored data request, a human being at the company looked at the account again, and the account came back. That is the only privacy route with that outcome on the record, and it starts with an access request - not a deletion request.

Keep it in proportion, though. The channel that reverses bans at scale is still the platform’s own appeal, and the platforms publish the numbers themselves in their EU Digital Services Act transparency reporting. These are theirs, not ours, and they are worth reading before you decide what to spend your one shot on.

Two things fall out of that table. The first is timing, and it kills a number you will see repeated all over this subject: nobody publishes a turnaround, and the honest sentence is most decisions land within a day, some take weeks, and no app promises a time. Bumble’s median is 61 minutes; Grindr’s is 281 hours, which is nearly twelve days, and that is the median rather than the tail. The second is that roughly one appeal in three gets reversed at the Match Group brands. Theirs, not ours. We publish our own numbers separately, including the zeros.

There is one more figure worth carrying into your case. Of Tinder’s 2,169,598 EU account terminations in 2025, 94% were scam, fraud and inauthentic-account sweeps, overwhelmingly automated. If you are a real person caught in an automated sweep, you are in the most reversible category there is, and the job of your file is to prove personhood rather than to argue morality. The conduct categories - harassment, harm, minors - were human-decided, and those are the cases we decline at intake.

What an erasure request does not do to your ban record

This is the part most guides get wrong, and it is worth being blunt: an erasure request does not delete your ban record. If you have read the opposite argument somewhere - that deleting the data leaves the fingerprinting machine nothing to match against, so the ban quietly stops working - it is a tidy theory that the platforms’ own published retention policies contradict in writing.

What they say they keep, in their own privacy documentation:

• Tinder keeps enforcement and safety records for as long as it considers necessary for the purpose, plus a further safety window of a year after account closure.
• Hinge describes retaining certain data for up to two years after an account ends.
• Bumble describes retention of some records for up to fifteen years.

None of that is a loophole they are sneaking through. Retention for the purpose of keeping banned users out is exactly the kind of processing regulators have accepted as capable of being lawful, and a refusal that names legitimate interests or the defence of legal claims and scopes it properly is a compliant refusal, not a scandal. You can argue about the scope - and further down we show you how - but you should not send the letter expecting the ban record itself to disappear.

Now the part that actually costs you money, because it is not merely that erasure fails to help. Sent early, it does damage.

• It destroys your evidence. Your account history, your messages, your billing records and your screenshots inside the app are the raw material for the appeal, for a DSA Article 21 case, for a refund claim and for a BBB file. Erasure asks the company to shred exactly that. The money routes in particular run on billing records you have just asked to have deleted.
• It can kill the login your appeal needs. Tinder’s Appeals Center runs inside the banned account: you sign in with the same credentials, read the case card, and press a button. There is no text box, no upload and no email address behind it. Whatever weakens or removes that login weakens the only channel that reverses Tinder bans at scale.
• It moots a live appeal. An appeal asks the platform to re-examine your account. An erasure request asks it to destroy the thing being examined. Running both at once is asking two departments to fight each other over your file.
• You get one shot in several places. Tinder will not take a second appeal on the same action - its own wording is that you may not appeal the same violation twice - and OkCupid, Plenty of Fish and Match say repeat submissions will not be considered and may move you back in the queue. Sequencing errors are not recoverable by trying again.

So the record is not the target. The file is. Which brings us to the request that actually opens it.

Article 15 in plain English: make them show what flagged you

Article 15 - the subject access request - entitles you to a copy of the personal data a company holds about you, plus the purposes it is processed for, the categories involved, who it is shared with, and how long it will be retained. It costs you nothing but an email and some patience, it runs on the same one-month statutory clock as erasure, and it does four jobs no other route can:

• It shows you what the ban record actually is. A category label? A device-identifier list? A note referencing another user’s report? You are currently fighting a record you have never seen. The access response turns a rumour into an inventory.
• It forces retention periods into writing. The disclosure is supposed to state how long each category is kept. Silence on that point, or a bare “indefinitely”, is the weakness your later erasure request will aim at.
• It makes every other filing specific. An appeal, a DSA case statement or a regulator complaint that quotes the platform’s own disclosed categories back at it is a different document from one built on guesswork.
• It creates the first compliance data point. If the response is late, thin or evasive, that is already material for the regulator - and, per the DPC’s published cases, an ignored access request is precisely what put a human back on those Tinder accounts.

If you were banned on Tinder, check what you already hold before you write anything. The case card inside the Appeals Center shows more than most people notice: a Case ID, the policy section cited, the violation type, a Flagged by line distinguishing automated detection from user reports from Tinder’s own review, and a Reviewed by line. Screenshot all of it. A “Flagged by: automated” card, held next to the fact that 94% of terminations were automated sweeps, is the spine of a personhood case - and it tells your access request what to ask for by name.

One caveat from observed practice: access packages from dating platforms are generous with profile data and thin on moderation data. The ban reason and the enforcement notes are often withheld or summarised, typically citing other users’ privacy or the integrity of the moderation systems. Do not treat that as a dead end. A written statement that moderation records exist but will not be shown to you is itself useful: it confirms the category exists, dates it, and gives your escalation something concrete to be about.

The access-request letter

The access request needs no artistry. It needs the statute, the account, and a list of categories specific enough that a generic export does not answer it. Send it to the privacy contact named in the app’s privacy policy, from the email address on the account, and keep proof of when it went.

Note the two clauses doing the heavy lifting, because they are what turn a data dump into leverage. Asking whether the action was flagged by automated means engages the platform’s own moderation taxonomy rather than yours. Asking it to name the exemption for anything withheld means a refusal to show moderation notes still hands you a dated, written admission that moderation notes exist. Send it, diarise the deadline, and get on with the routes in the parallel section while you wait.

The clocks: one month in Europe, forty-five days in the States

Both privacy requests run on statutory deadlines rather than on the company’s goodwill. That is the whole reason they are worth sending: a missed deadline is verifiable from a calendar, with no judgment call left for anyone to make.

Practicalities that decide whether the clock works for you:

• Put the request in writing and keep everything. Email the privacy contact listed in the app’s privacy policy - for Match Group apps, each brand publishes its own. If you have to use an in-app or web form, screenshot the submission and the confirmation. Your evidence trail is the asset this route produces even when the answer disappoints.
• Diarise two dates: the deadline from the day they received or verified the request, and the extension outer limit. Regulator complaints are built out of dates, and yours should be exact.
• Judge any extension notice on its reasons. “We are experiencing high volumes” is not a complexity argument - your request concerns one account. A genuine complexity claim would have to explain what, about one user’s file, takes three months. Most cannot.
• An extension notice that arrives in week five does not exist, legally speaking. It is lateness with a covering note, and it is worth saying so in the complaint.
• Silence past the deadline is not nothing - it is a finding. A missed statutory deadline is a compliance failure in its own right, and it is the easiest kind for a regulator to verify.

When they ignore it: the ICO, your DPA and the Irish DPC

A missed deadline is not the end of the route; it is the point where the route gets interesting. Where the complaint goes depends on where you are:

• UK: the Information Commissioner’s Office. The public complaints route is at ico.org.uk/for-the-public. You are expected to have complained to the company first - which your access request and their silence already constitute.
• EU: your national data protection authority. For most EU users of Match Group apps the lead authority is the Irish Data Protection Commission, because that is where the European entity sits, but you do not need to work that out yourself. File with your own country’s DPA; the one-stop-shop mechanism exists to route cross-border complaints to the lead authority.
• California and the US states: a different statute and a different door - covered in the CCPA section.

Build the complaint out of documents, not adjectives. The strongest version is almost clerical: request sent on [date]; identity verified on [date]; statutory deadline of [date]; response received on [date], or not at all; response failed to state retention periods or to name an exemption for what was withheld. Attach everything. What you are handing the regulator is a completed compliance test with the answers already marked wrong, and the less editorialising you do, the better it reads.

Be precise about what this can and cannot produce, because this is the one place on the site where a privacy filing has reinstatements behind it and we would rather you understood the mechanism than got excited about the headline. Regulators do not reinstate dating profiles. They have no power to, they say so, and they move in months rather than weeks. What happened in the DPC’s published cases is that a regulator’s correspondence about an ignored access request caused the company to look at the account again, and on looking again it reinstated. That is a second human read, obtained through a door the company did not choose. It is worth having. It is not a promise, and nobody can make it one.

One boundary worth marking, because it is where people waste a filing: this is the escalation for an ignored or defective access request. It is not an appeal against a lawful erasure refusal. A company that refuses to delete your ban record, names legitimate interests or the defence of legal claims, and scopes the refusal to the records it needs is not committing a breach for a regulator to find.

What to run while the access clock ticks

A month is a long time to sit still, and nothing about a pending data request requires it. These run in parallel, and none of them depends on the privacy routes.

The platform’s own appeal

The channel that reverses at scale, and the one where the details are per app rather than generic. Six months from the action is the published outside limit on Tinder, Bumble, Badoo, OkCupid, Match and Plenty of Fish; Hinge, Grindr and Feeld publish no window at all. Sooner is better everywhere. On Tinder it is a one-tap submission inside the Appeals Center with no statement box, so the craft goes into decoding the case card and into the routes that do take words. On Hinge it is the in-app Appeal button with a statement box, and emails to staff are not processed and can delay the queue. On Bumble and Badoo it is the form inside the block notification, or a “Dispute my block” ticket. On OkCupid, Plenty of Fish and Match it is one shared web form, one submission, and on OkCupid silence is the denial, since it replies only when it reverses. Grindr uses a web wizard with a hard 1,000-character cap and one file under 50MB. The appeal-writing guide covers the words; the ladder covers the order.

The Match Group escalation desk

Less well known than it should be, and free: Match Group runs a social support escalation desk at matchgroup-socialsupport.com that will take a second human look across any of its brands - Tinder, Hinge, OkCupid, Plenty of Fish, Match. You will need a reference from an existing customer-care ticket, so raise one first if you have not. It is one look, not a standing right of appeal, so it is worth spending after the in-app appeal rather than before.

The EU certified dispute body, named correctly

Under DSA Article 21, EU users can take a moderation decision to a certified out-of-court dispute body. Name the body rather than the category, because coverage differs and most guides get this wrong:

• Platform Control (Germany) handles Tinder, Hinge and OkCupid. Free, in German or English, open to EU residents and citizens, and you do not have to exhaust the in-app appeal first. File within 365 days of the action. The platform gets 14 days, extendable by 14, and a default decision can issue if it stays silent. Target 90 days, maximum 180.
• ADR Point (Greece) handles Tinder, Hinge and Bumble. Free, 40-day target, and here the in-app appeal must be filed first. Its form has a third-party field and its rules allow a paid representative to work alongside you.
• ADR Center (Italy) handles Hinge.
• No certified body currently lists Badoo, Grindr, Plenty of Fish, Match or Feeld.
• Appeals Centre Europe refuses dating apps outright. If a guide sends you there, or quotes you a character limit for its case statement, it is describing a body that will not take your case.

The decisions are not binding on the platform, and the platforms report implementing them unevenly - Tinder 62%, Hinge 72% in 2025. The full Article 21 guide has the mechanics, and the European Commission’s own page on out-of-court dispute settlement explains the framework.

The money, and the public record

Your paid subscription is a separate fight with separate deadlines - store refunds from your own Apple or Google account, 14 days on Tinder web and Hinge’s Stripe purchases, the EU and UK withdrawal right, three business days in twelve US states, Bumble’s 6-day weekly and 14-day monthly rule. It is all in the money guide, and it is the reason erasure waits.

The BBB is worth being honest about. US and Canadian residents can file one complaint per business per 24 months; the company gets 14 days to answer; the complaint and the answer stay visible for three years. What it does is build a public, dated record. What it does not do is lift bans - Match Group answers ban complaints with a template stating that Tinder is unable to process appeal requests submitted through the BBB portal, and plenty of complaints against other apps go unanswered entirely. File it if you want the record. Do not file it expecting a reversal.

Footnote, and only that: your State Attorney General logs patterns. Washington, Colorado, Texas and California all state in their own words that they do not investigate or resolve individual complaints. We will file it if you want your case in the pattern data. Nobody should sell it to you as a lever.

Article 17 in plain English, and when erasure is safe to send

GDPR Article 17 (EU), the UK GDPR’s equivalent, and CCPA §1798.105 (California) give you the right to request deletion of personal data a company holds about you. That right is real and worth exercising. It is simply not an unban mechanism, and the sequencing matters more than the drafting.

Article 17 is not unconditional. You need at least one of its grounds. In plain English, the grounds most relevant to a closed account are:

• The data is no longer necessary for the purpose it was collected for. This is your lead argument. The purpose was providing you a dating service. The company itself ended that purpose when it banned you. A closed account is, by the platform’s own act, an account whose data has finished most of its job.
• You object to the processing, and the company cannot show overriding legitimate grounds. Where retention rests on legitimate interests, and it usually does, you have a right to object, which forces the company to actually weigh its interest against yours rather than assert it.
• The processing was unlawful. Harder to establish, but relevant where the platform cannot point to any lawful basis for keeping specific categories - say, your full message history - years after account closure.
• Consent was the basis, and you withdraw it. Narrower than people assume, because platforms mostly do not rely on consent for moderation data. Include it; do not lean on it.

Who can use it? The GDPR protects people in the EU and the UK GDPR mirrors it for the UK. You do not need citizenship - being in the jurisdiction is the operative fact. For most EU users of Match Group apps (Tinder, Hinge, OkCupid and Plenty of Fish; note that Bumble is a separate company), the responsible entity sits in Ireland, which is why the Irish DPC keeps appearing above. Americans outside California have no comparable federal right, though the growing patchwork of state privacy laws borrows the same shape.

The fight you should expect: the safety exemption

Erasure is not absolute, and you should walk in expecting the fight rather than being disappointed by it. Companies can refuse where retention is necessary for legal obligations or the defence of legal claims, and platforms additionally argue that keeping ban records is necessary to keep banned users out. Expect a refusal on those grounds, and expect it to be at least partly correct. Two things still matter about it: it must be specific (a compliant refusal names its legal ground; a template brush-off with no ground at all is itself a compliance failure), and the scope is arguable even where the principle is not.

What they will argue

The refusal, when it comes, usually stands on some combination of three legs. First, defence of legal claims: enforcement records might be needed if the ban is ever litigated. Second, legitimate interests: the platform’s real interest in keeping removed users removed, framed as protecting the rest of the user base, and described in exactly those terms in their privacy policies alongside the retention periods quoted earlier. Third, a soft appeal to everyone’s safety that is more atmosphere than argument: nobody wants to be the company that deleted a record and readmitted someone dangerous. None of these legs is fake. That is why the counter-argument is not “safety does not matter” - it is the next section.

How to argue proportionality back

The GDPR’s principles of data minimisation and storage limitation say retention must be limited to what is necessary for the stated purpose, and necessity is where the platform’s position is weakest. Run the safety rationale to its logical end and ask what it actually requires:

• A blocklist purpose needs a matching key, not a dossier. Keeping a banned user off requires something to match against - arguably a hashed identifier. It does not require your message history, your photographs, your swipe activity or your bio from 2021. Safety justifies a lock, not an archive.
• Necessity is per-category, not all-or-nothing. A refusal that keeps everything on safety grounds is claiming your entire account is a safety record. Make them defend each category separately; that is why the template demands per-category grounds.
• Retention needs a schedule. Storage limitation means data kept for a purpose should have a defined period. The good news, if you can call it that, is that the major apps now publish one, so the argument shifts from “forever, in case” to whether fifteen years of a blocked account is proportionate to the stated purpose. Ask for the schedule as applied to your account and hold them to it.
• Proportionality tracks the ban reason. Argue this one with care and honesty: a platform retaining data indefinitely over an alleged terms breach with no safety dimension is making a much harder necessity argument than one holding records connected to safety reports. If your ban reason is mundane or unexplained - and a striking number are opaque even to the person banned - say so plainly and make the platform explain what safety purpose your photographs from four years ago serve.

Set your expectations at the right height. On these arguments the ban record itself will usually survive. What you are realistically pruning is everything around it: the photographs, the messages, the identifiers that had nothing to do with keeping you off the service. That is a worthwhile outcome for its own sake, and it is not an unban.

The copy-paste erasure letter

What follows is a template - fill the brackets, delete what does not apply, and resist the urge to decorate. The best erasure requests are boring: no ban story, no grievance, no threats. This letter is not an appeal (that is a different document with different rules); it is a statutory request and should read like one. Send it to the privacy contact in the app’s privacy policy, from the email on the account, after the checklist above is satisfied and your access response is in hand.

Note what the letter does, because every sentence is carrying weight. It names the statute. It identifies the account precisely so verification cannot eat the clock. It includes affiliated services, which is the Match Group cross-brand question in one phrase, since one company operates Tinder, Hinge, OkCupid and Plenty of Fish. It states grounds rather than feelings. It concedes, deliberately, that some categories may lawfully be retained - and then makes the company say which, and for how long, and confirm that the rest is gone. That concession is not softness; it is what stops the reply being a single sentence about safety that covers the whole account. And it reserves the regulator without threatening anybody.

What comes back: the three reply scenarios

Within the month, or the lawful extension, one of three things arrives. Each has a correct next move.

They comply fully: rare on a banned account, and worth confirming rather than assuming. Ask one follow-up question in writing: does the confirmation cover data held by affiliated services? A yes closes the Match Group loop. A hedge tells you what to ask about next. Note that full erasure of everything erasable still leaves the enforcement record where the company has told you it is keeping it.

They comply partially: this is the normal outcome, and it is more valuable than it looks. The written specification of what they kept and why is a map of what the ban actually rests on, and no appeal rejection ever gives you that. Read it against the proportionality arguments above: any category retained without a stated ground or period is a specific, nameable defect. And the specification feeds the routes that are still open - a DSA Article 21 case statement built on the platform’s own written retention position is a different animal from one built on guesswork.

They send boilerplate or nothing: complain to the regulator, attaching your request and their response. Regulators measure companies in deadlines and specificity, both of which you now have in writing. Silence is the strongest version of this branch, not the weakest, because there is no judgment call in a missed statutory deadline. On The Advocate, we build that regulator complaint as standard.

The Californian parallel: CCPA §1798.105

Californians get the domestic cousin of all this. The CCPA’s §1798.110 gives you the right to know what personal information a business has collected about you, and §1798.105 the right to request deletion. The mechanics rhyme with the European version: submit through the business’s designated privacy channel, verify your identity, and get a response inside the statutory window (the current deadlines and your full set of rights are laid out on the California Attorney General’s CCPA page). The sequencing rule is identical: ask what they hold first, ask for deletion last.

The exemption fight rhymes too. The CCPA lets businesses keep data needed to detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, which is where a ban-record retention argument pitches its tent, just as the safety exemption does in Europe. The same proportionality logic applies even though the statutory language differs: security purposes justify retaining what the security purpose needs, category by category, not the whole account in amber. Demand the same per-category specificity in a refusal.

Where the parallel weakens is enforcement. There is no Californian equivalent of filing an individual ICO complaint and having a caseworker assess your file; enforcement runs through the Attorney General and the state privacy agency, and a complaint joins the pile that informs their priorities rather than starting a case about you. Users in Virginia, Colorado, Connecticut and Texas have a better-shaped route: 45 days, a 45-day extension, then a 60-day internal appeal that the company must answer in writing, and only then the state AG. That internal appeal is the useful part, because it puts a second person inside the company on your file. Pair any of it with the money routes, which are fully available to Americans and, unlike the complaint routes, actually end in a number in your account.

What erasure honestly does for a future fresh start

Time for the section other guides write dishonestly. Search results around this topic are full of the implication that erasure is a legal cheat code: delete the record, stroll back in. That is not what this is, and pretending otherwise would put you in genuine trouble, so let us be exact about the boundary.

What erasure is not: a licence to create a new account while banned. The ban is a term of your contract with the platform, and it survives regardless of what data they hold - as the retention periods at the top of this guide make plain, the enforcement record is the thing they keep. A new account created to get around a ban breaches the terms on day one, whatever the state of their database. Worse, attempted resets are precisely what the modern enforcement stack exists to catch - the reset era is dying for exactly the reasons the device-ban piece lays out - and a caught evasion attempt can poison legitimate appeals that were still open. We do not help with evasion, and this article is not a workaround dressed in statute.

What erasure honestly is: record hygiene, and a right worth exercising for its own sake. Two real things it buys you. First, it ends the platform’s ongoing hold on your photographs, messages and identifiers - data you have every reason to want out of a company you no longer have a relationship with, ban or no ban. Second, it forces the retention rationale into writing, which is worth having on file even after the other routes have closed. What it does not buy you is a clean slate at the platform, because the piece of the file that defines you as banned is the piece they have told you, in advance and in public, that they are keeping.

Which is why the sequencing rule is the single most important sentence in this guide: erasure goes last. An appeal asks the platform to re-examine your account; an erasure request asks it to destroy the thing being examined. Run the appeal first. Most decisions land within a day, some take weeks, and no app promises a time - but the median at every Match Group brand is under a day and a half, so waiting for it costs you very little. Then the escalation desk, then the EU body if your app is covered, then the money, then the letter above. If you are unsure where you are in that sequence, the checker will place you.

What not to do

The failure modes of this route are mostly self-inflicted, and every one of them is avoidable:

• Do not send the erasure request first. This is the expensive mistake and the reason this guide was rewritten. Access first. Erasure last, once nothing else needs the evidence or the login.
• Do not confuse in-app account deletion with an erasure request. The “delete account” button is a product feature; platforms describe retaining various data after account deletion in their privacy policies. The statutory request is a different act with a different legal status. You may well do both - but only one of them starts a clock, and neither of them removes the ban.
• Do not send it to general support. Support queues are built to resolve tickets, not statutory requests. Use the privacy contact in the privacy policy, and keep proof of where and when you sent it.
• Do not claim a jurisdiction you do not have. Citing the GDPR from Texas does not make you European; it makes your letter dismissible on the first line, and it burns the credibility the rest of the letter needs. Use the CCPA if you are Californian, your state’s privacy law if it has one, and the consumer and refund routes if neither applies.
• Do not bury the request in a rant. The angrier the email, the easier it is to route to the apology-template queue. The statute does the intimidating; your job is dates and categories.
• Do not appeal the same action twice on Tinder. Its own wording is that you may not appeal the same violation twice, and on OkCupid, Plenty of Fish and Match a repeat submission will not be considered and may move you down the queue. One shot means one shot.
• Do not email executives or message staff on social media. Hinge’s help centre says such messages are not processed and can delay your queue position. It feels like escalation. It is the opposite.
• Do not raise a chargeback. It is a contractual ban trigger in Tinder’s and Hinge’s terms, it ends your refund rights, and it has cost people their Apple accounts. Use the proper refund routes.
• Do not miss the verification email. An unanswered identity check quietly kills the request, and the failure will be recorded as yours.
• Do not treat a refusal as the end. If it names grounds and periods, it is a lawful refusal and useful evidence. If it names nothing, it is a compliance failure with a regulator waiting.
• Do not pay anyone who sells erasure as an unban trick, and do not give anyone your password. A cottage industry sells exactly that. Anyone guaranteeing that deletion gets you back in is describing a mechanism they do not understand or selling one they cannot deliver.

Is a GDPR request against a dating app worth filing?

The access request: almost always. It costs one email, the clock is statutory, it is the only way to see what actually flagged you, and when it is ignored the escalation behind it is the one privacy route with reinstatements on the public record. Send it early, and send it even if you also intend to do nothing else.

The erasure request: yes, at the end, for what it honestly is. Expect the enforcement record to survive. Value it for the rest of the file coming down, and for the written retention position it forces. Do not value it as an unban, and do not let it near a live appeal.

If you would rather not run the sequence yourself, this is what we do. The case desk builds every route: the access request, the appeal your app actually accepts, the Match Group escalation statement, the EU pack where a certified body covers your app, the money claims, and at the end the erasure letter and, on The Advocate, the regulator complaint. We file every route in your name - Tinder’s Appeals Center runs on your own login and Hinge accepts appeals only in-app, so nobody else can lawfully submit those - and we file the rest in your name. We never ask for your password. Filed within 48 hours, 24 on The Advocate, or your money back, and we file anyway. Intake first, pay after; if we do not take the case, you are refunded. Start here and we will tell you at intake whether your case is one we take.

Questions people actually ask

Should I send an access request or an erasure request first?

Access, every time. It shows you what the platform holds, forces retention periods into writing, and is the request whose escalation has produced reinstatements in the Irish DPC’s published cases. An erasure request sent first deletes the evidence the access request would have given you, and can take the login your appeal runs on with it.

Does a GDPR erasure request remove a Tinder ban?

No, and it does not remove the ban record either. Tinder’s published position is that enforcement records are kept for as long as necessary plus a safety window after closure, and that retention can be lawful. File the erasure request for what it reliably produces - the rest of your data deleted and a written retention position - not for a reversal.

Has a data request ever actually got anyone back in?

Indirectly, and it is documented. In the Irish Data Protection Commission’s published cases, banned Tinder users whose access requests went unanswered complained to their data protection authority; after the DPC’s correspondence the company carried out a fresh review of the account and reinstated it. The regulator did not order reinstatement and could not have. What it produced was a second human look. That is worth having and it is not a promise.

Can Tinder refuse to delete my data?

Partially, yes. Erasure has exemptions, and a refusal citing the defence of legal claims or safety-adjacent legitimate interests is the expected move, often correctly. What it cannot lawfully do is refuse vaguely: a compliant refusal states its legal ground, and you have asked for grounds and retention periods per category. A refusal that skips that is the compliance failure you take to the regulator.

How long does a GDPR request take?

One calendar month from the request, in practice from identity verification, extendable by up to two further months for genuinely complex cases - and they must tell you about any extension, with reasons, inside the first month. California runs 45 days plus 45, with receipt acknowledged inside 10 business days. Escalation to a regulator afterwards runs on the regulator’s timetable, which is months.

How long does the appeal itself take?

Most decisions land within a day. Some take weeks. No app promises a time, and neither do we. The medians the platforms published for 2025 run from 61 minutes at Bumble to 281 hours at Grindr, and the tail is longer than the median everywhere.

Do I need a lawyer to send one of these?

No. Both rights are designed to be exercised by individuals, the letters above cover the mechanics, and regulator complaints are likewise built for unrepresented people. A lawyer becomes relevant only if you are contemplating actual litigation, which for most banned users is disproportionate to what is at stake.

Does deleting my dating app account delete my data?

No, and this is the most common confusion in the whole area. Account deletion is a product feature; platforms describe retaining categories of data afterwards, sometimes for years. Only the statutory request obliges a response about what is held and starts a clock. You can send an access request even if you deleted the account years ago.

Can I send an erasure request if I live in the US?

The GDPR will not apply to you, but Californians have CCPA §1798.105, and Virginia, Colorado, Connecticut and Texas among others have their own deletion and access rights with a 45-day clock and a 60-day internal appeal behind it. If no state law applies, your leverage lives in the platform’s own appeal and the refund routes. The BBB and your State Attorney General build a record; neither lifts a ban.

Will sending an erasure request make my ban worse or hurt my appeal?

It cannot deepen a ban - you are exercising a legal right, and retaliating against that would be its own problem for the platform. The genuine risk is sequencing, and it is real: erasure can moot a live appeal, destroy the evidence a refund claim or a DSA case needs, and remove the login Tinder’s Appeals Center requires. Appeal first. Erase last.

What happens if the platform just ignores my request?

Silence past the statutory deadline is the cleanest escalation you can be handed: a missed deadline is verifiable from a calendar, with no judgment call for a regulator to weigh. Complain to the ICO or your national data protection authority with the dated request attached, and let the absence of any response speak for you.