Grindr pays £26m over claims two analytics providers received users' HIV status
More than 11,000 UK claimants, two named analytics providers and no admission of liability have produced a hard figure for what one app's pre-2020 profile data was worth, payable in two £13m tranches.
The Watch · Security desk
What happened
- Grindr agreed to pay £26m to settle a lawsuit alleging it shared users' personal information, including HIV status, with third parties.
- A US regulatory filing sets the money as two £13m payments, the first due by 31 December and the second by 31 March 2027.
- The claim was filed in the High Court in 2024 and later served in the US, and the firm leading it says it signed up more than 11,000 claimants.
- Grindr says the allegations concern historical data practices before 2020, when the app was owned by the Chinese firm Kunlun, and that it disputes them.
Why it matters
- What it costs cost Today's Grindr pays for a configuration set under a previous owner, so acquirers now have a figure for what an inherited third-party data flow can cost after the deal closes.
- Who's exposed exposure The liability came from fields users volunteered and a vendor library could read, which puts every app holding self-declared health or orientation attributes in the same claim shape without an attacker anywhere in the story.
- What it sets up precedent An opt-in pool of UK claimants extracted an eight-figure sum without a regulator finding, making private litigation the faster pricing mechanism for special-category data leakage.
- What it limits constraint With no admission and no published finding, defenders get the price without a field-level account of what actually left the app, so nobody outside Grindr can copy the fix.
Next story · Invest · 4d ago
Norway fines Microsoft-owned Xandr 92 million crowns over Grindr users' data shared with advertisersConfirmed7 publishers
HIV status and the date of a user's last test are optional profile fields on Grindr, offered to reduce stigma and help users make informed health choices [13]. Ethnicity and sexual orientation sit in the same profile [9]. The allegation is that those attributes reached Apptimize and Localytics, two data analytics services, and that a potentially unlimited number of third parties then used the data to customise advertising to users [10][19]. As reported, the claim describes sharing for commercial purposes rather than an intrusion [9][19]. The outbound path ran through vendor instrumentation that had been configured to send that data.
The arithmetic sets a ceiling on the payout, not the payout itself. £26m spread across "more than 11,000" claimants is at most about £2,364 each [16]. The real per-claimant figure is lower, because the BBC's account of the filing does not separate legal costs from money reaching claimants [14].
The timeline is the part that travels. The sharing was reported in 2018, when Grindr defended it as being in line with industry standards and then stopped sending HIV data to the two providers [11]. The High Court claim was filed in 2024, six years after that [17]. The final £13m falls due on 31 March 2027, nine years after the original disclosure [18]. The 2018 fix addressed the flow; the underlying exposure stayed open until this settlement.
Grindr's position is that the conduct predates 2020 and its ownership by the Chinese firm Kunlun, and that it has since overhauled its privacy practices [6][12]. Its filing says the company "disputes the allegations" while acknowledging "the distress and loss of trust expressed by some of its UK users regarding that pre-2020 period" [5]. Chaya Hanoomanjee, the lawyer who led the claim, said in April 2024 that claimants had experienced significant distress and that Grindr owed compensation to the community it serves [15]. The BBC report describes a class action settlement with no admission of liability and records no regulatory finding or fine [4][8].
So the £26m is a settlement price, fixed outside any regulatory ruling. It was set by an opt-in claimant pool and a US regulatory filing [2][3], and for anyone tallying what special-category attributes are worth when a vendor library can read them, it is the only public quantity attached to those flows.
What to watch
- Whether any UK regulator opens or reports action on the pre-2020 sharing, which would add a second figure alongside the civil one.
- Whether the first £13m clears by 31 December or the schedule slips toward the March 2027 tranche.
- Whether Austen Hayes or another firm files the same claim shape against other apps that hold self-declared health or orientation fields.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence74
Perspective Coverage
5 publishers- Builder
- Builder 23%
- Operator
- Operator 51%
- Investor
- Investor 26%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Grindr agreed to pay £26m to settle a lawsuit over allegations it shared users' personal information, including their HIV status, with third parties.
- [2]
The law firm leading the case said it had signed up more than 11,000 claimants.
- [3]
According to a US regulatory filing, Grindr will make two £13m payments: £13m to the counterparties by 31 December and a further £13m by 31 March 2027.
- [4]
Grindr said the settlement includes no admission of liability.
- [5]
Grindr's filing said: "While Grindr disputes the allegations, it recognizes and acknowledges the distress and loss of trust expressed by some of its UK users regarding that pre-2020 period."
- [6]
Grindr said the claims relate to "historical data practices" before 2020, when the app was owned by the Chinese firm Kunlun.
- [7]
Grindr was sued in the High Court in 2024 over claims it misused people's personal information; the class action suit was later served in the US.
- [8]
The BBC report describes a class action settlement and does not report any regulatory finding or fine against Grindr over the sharing.
- [9]
The claims, brought by law firm Austen Hayes, alleged Grindr shared sensitive data with third parties for commercial purposes in breach of UK privacy laws, including information about users' ethnicity and sexual orientation.
- [10]
Two data analytics services, Apptimize and Localytics, were identified as third parties with access to the sensitive data.
- [11]
The claim followed revelations in 2018 that Grindr had been sharing personal data, including users' HIV status, with the two data analytics providers; Grindr defended the practice at the time as in line with industry standards and said it then stopped sharing HIV data with those companies.
- [12]
Grindr said in its filing that since 2020 it had "overhauled" its privacy practices and remains "committed to transparency, user control, and responsible data practices".
- [13]
Grindr users have the option to share their HIV status along with when they were last tested; the company says this aims to reduce stigma, facilitate conversations and help users make informed health choices.
- [14]
The BBC report does not break the £26m down between compensation reaching claimants and legal costs.
- [15]
Chaya Hanoomanjee, the lawyer who led the claim, said in April 2024 that claimants had "experienced significant distress" over their sensitive and private information being shared without consent, and that the company "owes it to the LGBTQ+ community it serves to compensate those whose data has been compromised".
- [16]
£26m divided among more than 11,000 claimants is at most about £2,364 per claimant, before legal costs.
- [17]
The High Court claim was filed six years after the 2018 revelations about the sharing.
- [18]
The second £13m payment falls due nine years after the 2018 revelations.
- [19]
The claim said a potentially unlimited number of third parties used the data to customise advertisements to Grindr's users.
Sources
5 independent publishers whose own reporting we read for this story.
- bbc.comGrindr to pay £26m to settle claims it allegedly shared users' HIV status
1 article · September 7, 2026
- infosecurity-magazine.comGrindr Settles UK Data Privacy Claims for £26m
2 articles · September 8, 2026
- malwarebytes.comGrindr settles HIV status data-sharing lawsuit for $35 million
1 article · September 8, 2026
- thehackernews.comGrindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing
1 article · September 8, 2026
- therecord.mediaGrindr settles privacy lawsuit tied to disclosure of users’ HIV statuses for $35 million
1 article · September 9, 2026
Topics and entities
Topics
- Data Privacy Litigation
- GDPR Enforcement
- Health Data Privacy
- Third-party SDK data sharing
Entities
- Grindr
- Norwegian Data Protection Authority
- Chaya Hanoomanjee
- UK Information Commissioner's Office
- U.S. Securities and Exchange Commission
- GDPR
- Kelly Peterson Miranda