Bumble's AI icebreakers are mainly breaking EU law

• Complaint against Bumble (EN)

OpenAI reads along. Around 50 million people use the dating app Bumble in order to find romantic partners, friends – or even business partners. While the app doesn’t provide specific user numbers for Europe, Germany alone accounted for 1.45 million users in 2024. Unfortunately, connecting people isn’t the only thing that Bumble does. In December 2023, the company introduced so-called AI Icebreakers to the “Bumble for Friends” section of the app. With this, the app allows OpenAI to access people’s personal profile data in order to AI-generate an opening message based on the information people have shared on the platform.

Lisa Steinfeld, Data Protection Lawyer at noyb: “Bumble forces its AI features on millions of European users without ever asking them for their consent. Instead, their personal data is being sent to OpenAI and fed into the company’s AI systems.”

Nudging people to “accept” the processing. The AI Icebreakers were introduced without ever asking people for their consent. Instead, Bumble users started to receive a pop-up as soon as they opened the app, which said: “AI breaks the ice. We use AI to help you get started with chatting. This allows you to ask questions that match the profile information of our members.” The banner clearly is designed to nudge users to click “Okay”. If you try to close it without doing so, it will reappear every time the app is reopened and until you finally click “Okay”. While this suggests that Bumble relies on (annoying forms of) consent, Bumble seems to merely pretend to ask for consent, which gives people a false sense of control.

Lisa Steinfeld, Data Protection Lawyer at noyb: “The fact that Bumble presents its users with option to say ‘Okay’ to AI Icebreakers is misleading. It creates a false sense of control over your own data. In reality, Bumble claims to have a so-called legitimate interest to use your data without any consent.”

Consent – or rather legitimate interest? Although users are pressured into actively confirming that they’re OK with OpenAI accessing their personal data, Bumble doesn’t rely on consent under Article 6(1)(a) GDPR as the legal basis for the processing. Following several attempts to obtain access to her data under Article 15 GDPR, the complainant finally received a copy of her data and (incomplete) information about the company’s data processing in connection with the AI Icebreaker feature. Although Bumble failed to provide information about the specific recipients of user data, the company said that it actually relies on an alleged legitimate interest under Article 6(1)(f) GDPR to process data for its AI features.

Lisa Steinfeld, Data Protection Lawyer at noyb: “Bumble’s claim to have a legitimate interest in sending user data to OpenAI is absurd. The dating app seems to be so desperate to get in on the AI hype that it is trampling on users' fundamental rights in the process.”

Complaint filed in Austria. noyb has therefore filed a complaint with the Austrian data protection authority (DSB). Bumble has violated its transparency obligations under Article 5(1)(a) GDPR by failing to provide information about the processing in relation to the Icebreaker feature and by confusing users with a “fake” consent banner. Furthermore, the company lacks a legal basis under Article 6(1), as it cannot legally claim to base its processing on legitimate interest and has never sought consent. This is further illustrated by the fact that the complainant’s profile includes sensitive data such as sexual orientation, which can only be processed with explicit consent (Article 9). Last but not least, Bumble failed to adequately respond to the complainant’s access request (Article 15). noyb requests Bumble to stop the unlawful processing and to start using a proper legal basis for the Icebreaker feature. Finally, noyb suggests that the DSB impose an administrative fine to prevent similar violations in the future.