Grindr will pay £26m for data sharing that happened under a previous owner
The bill covers pre-2020 practices at an app then owned by Kunlun, and it is today's Grindr that pays, in two £13m tranches with the last not due until 31 March 2027. More than 11,000 UK claimants signed up.
The Product Desk
What happened
- Grindr will settle for £26m in two equal £13m payments, one due by 31 December and the second by 31 March 2027, according to a US regulatory filing.
- The claim, brought by law firm Austen Hayes, alleged Grindr shared sensitive data including users' ethnicity and sexual orientation with third parties for commercial purposes in breach of UK privacy law.
- Grindr says the allegations concern historical data practices from before 2020, when the app was owned by the Chinese firm Kunlun, and the settlement carries no admission of liability.
- Regulators had already acted on the same period: Norway's data protection watchdog fined the company £5.5m, and the UK Information Commissioner's Office issued a reprimand in 2022.
Why it matters
- What it costs cost The money leaves the company that exists now rather than the owner that ran the app in 2018, and it clears two dates either side of a year end, so an old instrumentation choice sits on two future sets of accounts.
- What it sets up precedent A private UK class action extracted roughly 4.7 times what the Norwegian regulator fined, which makes claimant firms, not data protection authorities, the expensive route for any app holding self-declared health attributes.
- Who has to decide decision Diligence on a consumer app now has a dated question attached: which sensitive fields ever sat in an outbound payload, and on what date the sending stopped.
- What doesn't add up contradiction Grindr disputes the allegations and concedes no liability while acknowledging its UK users' distress and loss of trust in the same filing, so the £26m records a grievance without ever testing it.
Next story · Security · 13h ago
CenterPoint Energy reports 1,062,060 Texans had Social Security and license numbers compromisedConfirmed2 publishers
The HIV field on a Grindr profile is optional, and the company's stated reason for having it is to reduce stigma and help users make informed health choices [14]. A user who fills it in has been told the disclosure serves them. What a team tells itself is that this is a feature with a health rationale. What the field also is, once it exists in the schema, is a property on a user record that goes wherever user records go.
The claim identified two data analytics services, Apptimize and Localytics, as third parties with access to the sensitive data [16], and alleged that a potentially unlimited number of third parties used it to customise advertising to users [10]. The sharing was reported in 2018, when Grindr defended the practice as in line with industry standards and then said it had stopped sending HIV data to those two providers [11][12].
The lag is the part worth staring at. Six years passed between that 2018 reporting and the High Court claim [18], and the settlement itself was reached on 2 September, according to Grindr's filing to the SEC [7]. Across the 11,000-plus claimants the law firm signed up, £26m works out at no more than about £2,360 a head before legal costs [20]. That is a concrete number for anyone inside a product org arguing against adding one more property to an outbound payload, and it is more use than a principle.
The person who answers for this is rarely the person who chose the SDK. It is whoever owns the schema now, which is the whole point of the pre-2020 framing: Grindr says the conduct belongs to the Kunlun era [6], and the cheque still clears from the balance sheet of the company that files with the SEC today.
The test worth running is unglamorous. List the fields a user can fill in that they would also mention to a doctor or hide from an employer. Against that, list every destination the profile record reaches, including analytics SDKs and warehouse syncs and anything an ad partner can read. Put sensitivity on one axis and destination count on the other. The fields sitting high on both are the ones still generating invoices six years on, and an overhaul of privacy practices dated to 2020 [13] does nothing about the payloads already sent.
What to watch
- Whether the first £13m clears by 31 December, given the second tranche is not due until 31 March 2027.
- Whether Austen Hayes's claimant count rises above the 11,000 it reported, which moves the per-head figure.
- Whether the UK ICO returns to the pre-2020 period it only reprimanded in 2022, now that a private claim has settled for £26m.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives60
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Grindr has agreed to pay £26m to settle a lawsuit over allegations it shared users' personal information, including their HIV status, with third parties.
- [2]
Grindr was sued in the High Court in 2024 over claims it misused people's personal information, and the class action was later served in the US.
- [3]
The law firm leading the case said it had signed up more than 11,000 claimants.
- [4]
According to a US regulatory filing, Grindr will make two £13m payments: £13m to the counterparties by 31 December and a further £13m by 31 March 2027.
- [5]
Grindr said the settlement includes no admission of liability.
- [6]
Grindr stressed the claims relate to "historical data practices" before 2020, when it was owned by Chinese firm Kunlun.
- [7]
The filing submitted to the US Securities and Exchange Commission by Grindr said a settlement had been reached on 2 September.
- [8]
Grindr said in the filing that while it disputes the allegations, it "recognizes and acknowledges the distress and loss of trust expressed by some of its UK users regarding that pre-2020 period".
- [9]
The claims, brought by law firm Austen Hayes, alleged Grindr had shared sensitive data with third parties for commercial purposes in breach of UK privacy laws, including information about users' ethnicity and sexual orientation.
- [10]
The claim said a potentially unlimited number of third parties used the data to customise advertisements to Grindr's users.
- [11]
The claim followed revelations in 2018 that Grindr had been sharing personal data, including the HIV status of its users, with the two data analytics providers.
- [12]
Grindr defended the practice at the time as in line with industry standards, but said it then stopped sharing HIV data with those companies.
- [13]
Grindr said in its filing that since 2020 it had "overhauled" its privacy practices to help meet the "unique needs of its community", and that it "is and remains a safe space for users, committed to transparency, user control, and responsible data practices".
- [14]
People on Grindr have the option to share their HIV status along with when they were last tested, a move the company says aims to reduce stigma, facilitate conversations and help users make informed health choices.
- [15]
Chaya Hanoomanjee, the lawyer who led the claim, said in April 2024 that claimants had "experienced significant distress" over their sensitive and private information being shared without their consent, and that the company "owes it to the LGBTQ+ community it serves to compensate those whose data has been compromised".
- [16]
Two data analytics services, Apptimize and Localytics, were identified as third parties with access to the sensitive data.
- [17]
Grindr was fined £5.5m by Norway's data protection watchdog and, later in 2022, reprimanded by the UK Information Commissioner's Office for its data practices.
- [18]
Six years separate the 2018 revelations about Grindr's data sharing and the 2024 High Court claim.
- [19]
The two settlement deadlines, 31 December and 31 March 2027, fall in different calendar years, so the cash cost spans at least two reporting years.
- [20]
Spread across more than 11,000 claimants, the £26m settlement is at most about £2,360 per claimant before legal costs.
- [21]
The £26m settlement is about 4.7 times the £5.5m fine imposed by Norway's data protection watchdog.
Sources
2 independent publishers whose own reporting we read for this story.
- bbc.co.ukGrindr to pay £26m to settle claims it allegedly shared users' HIV status
1 article · September 7, 2026
- mashable.comGrindr to pay £26 million to settle lawsuit after allegedly sharing users' HIV status | Mashable
1 article · September 7, 2026
Topics and entities
Topics
- Data Privacy Litigation
- Health Data Privacy
- Third-Party and Affiliate Data Sharing
Entities
- Grindr
- Chaya Hanoomanjee
- UK Information Commissioner's Office
- U.S. Securities and Exchange Commission