Grindr Settles £26 Million Lawsuit Over Misuse of Personal Data
Grindr, the popular LGBTQ dating application, has reached a settlement worth £26 million ($35.2 million) in response to allegations regarding the unlawful processing of users’ personal data and the misuse of private information prior to 2020. The agreement was officially announced on September 2, and the details were subsequently disclosed to investors in a filing with the U.S. Securities and Exchange Commission (SEC) two days later.
The lawsuit centers on data practices that occurred while Grindr was under the ownership of the Chinese conglomerate Kunlun. The company has maintained that the settlement does not constitute an admission of liability; rather, it continues to dispute the serious allegations made against it. Under the terms of the agreement, Grindr will pay £13 million ($17.6 million) by December 31, 2026, with an additional £13 million to be paid by March 31, 2027.
The Allegations Behind the Lawsuit
The legal action was initiated by the law firm Austen Hays at the High Court of England and Wales on April 22, 2024. The firm claimed that Grindr unauthorizedly shared sensitive personal data with third parties without obtaining adequate consent from users. According to Austen Hays, this sensitive data included users’ HIV status, their last tested date, and whether they were taking PrEP (pre-exposure prophylaxis). Additionally, ethnicity and data concerning users’ sexual life or orientation were also allegedly vulnerable to sharing during the relevant time frame.
This claim specifically concerns users of Grindr’s free version between the years 2016 and 2020. In 2018, Grindr disclosed its practice of sharing HIV-related data with analytics companies Apptimize and Localytics, a decision it ceased following investigations from Norwegian researchers that highlighted the arrangement’s ethical and privacy violations.
Health-related information, sexual orientation, and data about one’s sex life are accorded special protections under UK data protection laws. These laws designate such types of information as having the highest risks for unlawful data sharing, thus exposing violators to severe regulatory and civil penalties.
Acknowledgment of User Sentiment
Grindr’s recent filings have also expressed an acknowledgment of the distress and loss of trust reported by numerous UK users regarding the company’s past practices prior to 2020. While the company disputes the claims, it appears intent on mending its relationship with its user base, suggesting an awareness of the impact historical actions may have had on customer trust.
Conclusion of Historical Privacy Claims
The action initiated by Austen Hays encompasses two claims, reportedly representing around 12,000 individuals. If the settlement were distributed equally among these claimants, each individual could receive an average of approximately £2,167 ($2,928), although the specific methods of distribution have yet to be finalized.
Grindr has noted that it was sold to new ownership in 2020 and has since undertaken significant reforms to its privacy practices. The company positions itself as a safer space, emphasizing a commitment to transparency and user control in the processing of personal data.
However, Grindr is not alone in facing scrutiny for its data practices. In 2021, Norway’s data protection authority imposed a fine of €6.5 million ($7,549) on Grindr for sharing user data for behavioral advertising without any legal basis. This penalty was further affirmed when Grindr’s appeal to the Oslo District Court was denied in 2024. Furthermore, the UK Information Commissioner’s Office issued a reprimand to Grindr in July 2022 for failing to provide effective and transparent privacy information to its UK users.
As Grindr continues to evolve under new ownership, a pivotal question looms: can the company restore the trust of its user base and ensure that its future practices align with the robust ethical standards expected in today’s digital landscape? This settlement is a significant milestone, yet it serves as a reminder of the pressing need for companies, especially those dealing with sensitive personal information, to adhere strictly to data protection laws, ensuring the highest standards of user privacy and transparency.