Digital Data Leeches: How Tech Giants Profit From Your Secrets

When you install an app and tap yes to its permission request, you're usually thinking about convenience. You want the app to work. You don't think much beyond that moment. But what happens next—where your data goes, who sees it, what gets built from it—is the real transaction taking place, and it happens largely out of view.

The Grindr case makes this visible in the starkest possible way. Around 12,000 users in Britain sued the dating app, which caters to the LGBTQ+ community, alleging that it had shared their most intimate information with advertisers without permission. The data in question wasn't vague or generic. It included sexual preferences, location patterns, and in some instances, HIV status. Earlier this week, Grindr agreed to pay the claimants 26 million pounds—roughly 30 million euros or 35 million dollars. The company has not admitted wrongdoing and continues to dispute the allegations, but the settlement stands. For the users involved, it represents at least some acknowledgment that something went wrong.

Grindr is one case, but it illuminates a much larger machinery. When you give WhatsApp access to your phone's contacts, the app uploads all those phone numbers to its servers—including numbers belonging to people who don't use WhatsApp and never consented to having their information shared. That data flows into what digital policy experts call an "enormous profile." Google and other major tech companies then package these profiles into targeting products. A car manufacturer or clothing brand can tell Google: reach these people, show them my ads across Google Search, Gmail, and hundreds of millions of third-party websites that run Google's advertising network. The advertiser doesn't need to know your name. They just need to know you fit the target.

These profiles are built from two streams of data. Some comes from what you voluntarily enter—your stated preferences, photos you upload, information you type into your profile. But much of it is inferred. If a company has your location data and knows where you spend your nights, it can assume that's your home address. If that address is in an expensive neighborhood, the company can estimate your income. If your phone's location history shows you regularly visiting a gay club, the inference becomes obvious. All of this gets added to the profile, sorted, and sold.

The European Union has built some of the world's strictest data protection laws to push back against this. The General Data Protection Regulation, or GDPR, aims to protect personal data and privacy. The Digital Markets Act and Digital Services Act are meant to prevent tech companies from abusing their power. US companies operating in Europe must comply. The EU Commission has imposed substantial fines: Apple paid 500 million euros in 2025, Meta paid 200 million euros, Google paid 890 million euros. These are large numbers. But they need context. Alphabet, Google's parent company, had a net profit of around 117 billion euros in 2025. The fines amount to days of profit. "They just include it in their budget," says Jan Penfrat, a digital policy expert at European Digital Rights, an NGO network defending fundamental rights in the digital realm.

This is where the enforcement gap becomes clear. Tech giants have global infrastructure, enormous financial resources, and business models so complex that European regulators struggle to navigate them. Europe also depends heavily on US companies for cloud services, operating systems, platforms, and increasingly AI infrastructure. That dependency limits Europe's leverage. Penfrat argues that Brussels lacks the political will to take firmer action and to properly fund the data protection authorities that would need to enforce it. The result is a system where the rules exist but the penalties are too small to change behavior. The machinery keeps running.