Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document establishes Bumble's practices for collecting, using, and sharing personal information from users of its dating application and websites. Bumble collects sensitive data categories including precise geolocation, biometric identifiers for verification purposes, photographs submitted for identity verification, device information, and message content, with authorization to share this information with third-party service providers, affiliated entities, and government bodies in response to legal process. Users located in California, the EU, and the UK are granted specific rights to access, correct, delete, and export their personal data, exercisable through the application settings or Bumble's support contact mechanism.
This document is Bumble Group's global privacy policy, governing the collection, use, storage, and disclosure of personal information by Badoo Trading Limited and Bumble Trading LLC across the Bumble mobile application, desktop version, and associated websites, with GDPR cited as a primary legal framework and Bumble positioned as data controller. The policy states it collects a broad range of data categories including registration details, geolocation, device identifiers, biometric data (for profile and ID verification), purchase information, message content, photo metadata, and linked social media data, and the terms authorize use of this information for matching algorithms, moderation, service delivery, marketing, fraud prevention, and legal compliance. Notably, the policy discloses collection and processing of biometric data through profile and ID verification features, a category subject to heightened legal requirements in several US states (including Illinois BIPA and Texas CUBI) and under GDPR Article 9 as a special category; the policy also acknowledges use of automated decision-making including profiling, and discloses that user data may be transferred internationally outside the EEA under standard contractual clauses or other approved transfer mechanisms. The policy engages GDPR, UK GDPR, CCPA/CPRA for California residents, and potentially Illinois BIPA and other US state biometric privacy statutes, with enforcement exposure distributed across the ICO (UK), EU supervisory authorities, California Privacy Protection Agency, and US state attorneys general. Material compliance considerations include the lawfulness of biometric data processing under both GDPR and US state law, the adequacy of consent mechanisms for special category data, and the sufficiency of disclosed cross-border data transfer safeguards.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial4 important changes detected
5 versions captured · Last updated: May 2026
Bumble removed the UK from its list of server locations in its privacy policy. The updated language now states the network includes servers in the US and the EU, whereas …
View change record →Bumble updated its privacy policy on March 19, 2026 to specify that its network infrastructure includes servers located in the US, UK, and the EU, rather than the previous statement …
View change record →New explicit provision disclosing that message and communication content is collected and processed, a significant privacy consideration for dating app users.
New provision explicitly stating policy change procedures and notification methods, establishing transparency around future policy modifications.
Removal of explicit provision on law enforcement disclosure practices could indicate either integration into broader data sharing sections or reduced transparency on government data requests.
Removal of dedicated data retention provision eliminates explicit user visibility into how long personal information is maintained, a key privacy protection.
Removal of corporate transaction disclosure eliminates transparency on data handling during mergers, acquisitions, or asset sales, reducing user control notification.
Previous version had no excerpt; current version now provides specific detail that biometric data is collected for ID verification purposes.
Severity downgraded from 'high' to 'medium' and provision renamed from 'Precise Geolocation Data Collection' to 'Geolocation Data Collection,' suggesting reduced emphasis on precision tracking.
Provision renamed from 'Algorithmic Profiling and Automated Matching' with added section reference 'Our Use of Algorithms' providing more specific policy documentation.
Severity downgraded from 'high' to 'medium' and reframed from 'Third-Party Advertising Data Sharing' to 'Third-Party Data Sharing with Service Providers,' narrowing scope from advertising to service assistance.
Previous version had no excerpt; current version provides section reference with explicit focus on handling and storage procedures.
Monitoring
Bumble has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Automated Profiling and Matching Algorithms and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.