Dating apps and social platforms

• Regulation (EU) 2016/679 — GDPR, Articles 9 and 27
• Regulation (EU) 2022/2065 — DSA
• Regulation (EU) 2024/1689 — AI Act prohibitions
• Directive 2002/58/EC

Who has to appoint one

Providers outside the Union operating dating or social services used in the EU. Profile data in this sector routinely reveals sexual orientation, religious beliefs and health information, which is special-category data requiring an Article 9 condition.

Thresholds and exemptions

No threshold. Very large platforms above 45 million monthly users face the additional DSA regime supervised by the Commission.

What must appear on the label

Not physical. The representatives' identities in the privacy notice and in an easily accessible part of the service, transparent moderation policies, and advertising identifiable as such.

Marketplace fields

App stores enforce data-safety declarations and age ratings. Data protection authorities have fined services in this sector over retention, transfers and inadequate deletion of profiles.

Documentation you must hold

Article 30 records, both representative designations, a data protection impact assessment addressing special-category data, explicit consent mechanics for the sensitive attributes, retention and deletion procedures including for deleted accounts, DSA notice-and-action and statements of reasons, and transparency reporting.

Standards and testing

Not applicable, though age assurance and content moderation systems are examined, and emotion inference or manipulative design is prohibited under the AI Act.

Language requirements

Notices, consent flows and complaint procedures in the language of the users.

When it applies

Both representatives before the service is offered in the Union. DSA obligations since February 2024.

How long records are kept

Profiles must be deleted on account closure, with a short and documented grace period. Retaining photographs and messages after deletion has been penalised repeatedly.

What happens if you do not comply

Up to €20 million or 4% of turnover under the GDPR, and up to 6% under the DSA. This sector attracts complaints at volume because users are highly motivated to exercise their rights.

Who enforces it

Data protection authorities, Digital Services Coordinators and the Commission for very large platforms.

Where the boundary lies

Inferring sexual orientation from behaviour, even without asking, is processing special-category data, and the Court of Justice has confirmed that inferred sensitive data is covered. Profiling minors for advertising is prohibited outright.

Questions we are asked

Is sexual orientation special-category data?

Yes, under Article 9, and it requires explicit consent in this context. Inference counts as processing it.

What must happen when a user deletes their account?

Actual deletion within a documented period, including photographs and messages. Retaining them for analytics or safety without a clear basis has been fined.