The Platform Question: Power, Accountability and Global South The Platform Question: Power, Accountability and Global South Data Privacy Globally, online dating platforms collect and process highly personal and sensitive user data, which can include personal identifiers and interests, device metadata, precise location data, demographic information like religious and political beliefs, and sometimes biometric and financial data.12 They often collect additional data through social media integration13 and user behaviour like swiping habits and frequency of app use.14 While access to some of this data can support user experience, many dating platforms share data with third parties for targeted advertising.15 A Mozilla Foundation study of 25 dating applications popular across North America and Europe found that 80% of them may share or sell user data to third parties for advertising.16 A 2020 report by the Norwegian Consumer Council found that popular dating platforms like Grindr, Tinder and OKCupid share sensitive personal information, including their users’ exact location, sexual orientation, political beliefs, etc., to third parties.17 A 2020 report by the Norwegian Consumer Council found that popular dating platforms like Grindr, Tinder and OKCupid share sensitive personal information, including their users’ exact location, sexual orientation, political beliefs, etc., to third parties. 42 Often, users are unaware of the nature and extent of such data sharing. Many platforms’ privacy policies do not clearly disclose data-sharing practices,18 and these clauses often remain hidden within obscure and dense terms of service. Often, the privacy policies do not mention details of these third parties, and even in the few cases where company names are explicitly provided, users must read the privacy policies of these third parties to truly comprehend how they process their personal data.19 Studies on privacy policies across platforms and regions have found that users pay little attention to them, and that these policies fail to provide meaningful consent, often on account of complex legalese and information overload.20 In the EU, much of the data collected by dating platforms falls within what the General Data Protection Regulation (GDPR) recognises under a “special category”, requiring explicit consent for collection and processing, as it may heighten risks of discrimination and infringe on fundamental rights of citizens.21 In the Indian context, the personal data of users on online dating platforms has been particularly vulnerable in the absence of a data protection law, which, while enacted two years ago,22 has still not been enforced. Further, users in India Platform Accountability in Online Dating are less likely to benefit from additional safeguards accorded to sensitive personal data even after the Digital Personal Data Protection Act 202323 comes into force, given the absence of a separate category of protection for sensitive personal data.24, 25 Moreover, India’s data protection framework does not specify mechanisms for obtaining granular consent, unlike other major data protection frameworks across the globe,26 forcing users to either share all requested data or entirely forgo services. This becomes all the more relevant as several dating platforms are integrating AI, in addition to complex matching algorithms, within their services in the form of chatbots,27 picture selection tools, and profile or messaging feedback.28 However, the use of personal data for AI features often leads to the sharing of data with third parties. For instance, recently, the European nonprofit noyb filed a complaint with the Austrian Data Protection Authority against Bumble’s processing of personal data for its AI Icebreakers feature, which relies on OpenAI’s ChatGPT to aid users in starting conversations.29 In the past, the US Federal Trade Commission (FTC) filed a petition for information about a data-sharing deal between the Match Group’s OkCupid and Clarifai AI that enabled the training of facial recognition software without users’ knowledge or consent.30 Without adequate data security safeguards and consent mechanisms, privacy violations through data breaches and illicit data sharing can expose users to risks like identity leaks, surveillance, and reputational harm.31 Women and marginalised communities face disproportionate risks from data breaches. A 2023 study by Cybernews revealed that it was possible32 for hackers to triangulate users’ almost real-time locations by retrieving the last known location ID of any OkCupid user.33 This vulnerability could have exposed women to stalking and sexual violence, and endangered members of the LGBTQIA+ community.34 Dating platforms can also facilitate surveillance of sexuality in jurisdictions where homosexuality is criminalised. For instance, in Cairo, police officers detained a man simply for having downloaded same-sex dating apps on his phone.35 In India, despite the decriminalisation of homosexuality,36 queer individuals continue to face stigma and violence, with queer men reporting assaults, robberies, and blackmail through threats of being outed on platforms like Grindr.37 Further, Platform Accountability in Online Dating India’s data protection framework does not specify mechanisms for obtaining granular consent, unlike other major data protection frameworks across the globe, forcing users to either share all requested data or entirely forgo services. 43