TikTok unlawfully tracks your shopping habits – and your use of dating apps

Privacy NGO noyb has filed two complaints with the Austrian data protection authority against TikTok (and separately against TikTok, AppsFlyer and Grindr), alleging unlawful cross-app tracking, improper sharing of sensitive data (including Grindr usage) without a lawful GDPR basis, and an incomplete response to a data access request. The complaints cite violations of Articles 12, 15, 6(1) and 9(1) GDPR and request remedies including provision of missing data, cessation of processing and an Article 83 GDPR fine, creating regulatory and reputational risk for the companies involved and potential enforcement costs or operational changes should the DSB act.

Analysis

Market structure: This complaint disproportionately hurts app-level ad/analytics ecosystems (GRND, AppsFlyer, third‑party SDK monetization) and benefits privacy-first vendors and enterprise security providers. Expect ad CPM re‑allocation away from high‑granularity behavioral targeting toward contextual and first‑party channels over 6–24 months, pressuring margins of smaller ad‑dependent apps by an estimated 5–15% if enforcement scales.

Risk assessment: Tail risks include a GDPR fine up to 4% of global turnover, temporary EU app restrictions, or precedent forcing SDK changes; each could cause a 20–60% revenue shock to exposed specialists (weeks→months) and higher cost of capital (quarters). Hidden dependency: many consumer apps’ revenue models are structurally linked to a few SDK vendors (AppsFlyer), so enforcement against one node can cascade quickly. Key catalysts: Austrian DSB acknowledgement/notice in 1–3 months, preliminary findings in 3–9 months, final sanctions 9–18 months.

Trade implications: Direct short on GRND (GRND) is the highest-conviction trade near term; hedge via 3‑month ATM puts sized to 2–3% portfolio to limit downside. Opportunistic long in cybersecurity (CRWD, OKTA) 1–2% positions over 6–18 months to capture re‑platforming spend; consider pair trade long CRWD, short GRND to isolate privacy‑replatforming exposure. Trim exposure to adtech high‑beta names (e.g., TTD) by 1–3% and reallocate to security.

Contrarian angles: Markets may overprice immediate existential risk to GRND—if DSB issues a limited remedy rather than a large fine, GRND could rebound 30–50% within 3–6 months. Historical parallels (ad‑tracking regulatory scares) show initial steep drops and partial recoveries driven by remediation and paid models. Risk: heavy enforcement could accelerate subscription conversion among apps, creating winners in paid‑service niches.

Key Decisions for Investors

• Establish a 2–3% notional short exposure to GRND via a combination of short stock and 3‑month ATM puts (size puts to cover short position). Target exit: close on DSB preliminary finding or 50% price move; stop‑loss: 25% adverse move.
• Initiate a 1–2% long position in CrowdStrike (CRWD) or Okta (OKTA) to play increased enterprise security spending; prefer 6–18 month holding period and consider 6‑month call spreads (debit) to limit capital at risk.
• Reduce net exposure to high‑granularity adtech names (e.g., TTD and small ad‑dependent apps) by 1–3% of portfolio immediately and redeploy into cybersecurity/privacy names within 5 trading days.
• Set event triggers: if Austrian DSB acknowledges complaint within 30–60 days or public reports cite a probable fine >€5–10M, increase GRND short to 4% notional and buy additional 3–9 month put protection; if regulator signals only disclosure remedies, reduce short by 50% within 5 trading days.