Grindr will pay users £26 million over an HIV status data leak. How did this happen?

Popular gay dating app Grindr has agreed to pay a massive settlement in the United Kingdom. Around 12,000 users accused the service of sharing sensitive information—including their HIV status—with third-party advertisers without their consent. We examine how personal medical data became a tool for targeted advertising, why compensation is being paid now, and how much those affected will receive.

Grindr will pay £26 million (about CAD 48.6 million or more than RUB 3 billion) to settle a class-action lawsuit in the United Kingdom. The agreement brings an end to a legal dispute that began in April 2024, when London law firm Austen Hays filed a claim with the High Court of England and Wales.

The company has agreed to pay the first half of the amount (£13 million) by the end of 2026 and the remainder by the end of March 2027. The company does not formally admit wrongdoing and denies the allegations, but has agreed to settle the dispute while acknowledging the “distress and loss of trust” experienced by users.

How did personal health data end up in the hands of advertisers?

Grindr users can voluntarily list their HIV status, the date of their last test, and PrEP use (medication for pre-exposure prophylaxis against HIV) on their profiles. For many, this is an important aspect of sexual safety, as transmitting a sexually transmitted infection in the United Kingdom without a partner’s informed consent to the risk of infection may result in prosecution.

The claimants allege that Grindr took this intimate data and shared it with advertising companies such as Localytics and Apptimize to target and personalize ads. From there, the data may also have been passed on to “fourth parties.” All of this allegedly took place without the users’ proper and explicit consent, despite their expectation that the information would remain confidential.

Who will receive compensation, and how much?

The claim was filed on behalf of 12,000 users, who used the free version of the app between 2016 and early 2020. If the total settlement amount is divided equally, each claimant will receive an average of about 2,167 pounds (approximately 253,600 rubles or 4,050 Canadian dollars).

The most important detail: the High Court of the United Kingdom granted all claimants complete anonymity. This was done to protect people from having their personal data and medical status disclosed during public court proceedings. The participants' names are withheld from the public and court records.

What does China have to do with it?

Grindr says the claims concern “historical data practices” from before 2020. At the time, the app was owned by Chinese gaming company Beijing Kunlun Tech.

The Chinese owners were ultimately forced to sell Grindr to the San Vicente Acquisition consortium of American investors for $608–620 million precisely because of the US government's national security concerns: US authorities feared that Chinese intelligence agencies could gain access to Americans' sensitive data, including their messages and HIV status. The company subsequently changed its management, updated its privacy policy, and went public.

Is this the first scandal of its kind involving Grindr?

Far from the first. The app has long been in the crosshairs of European regulators:

• Back in 2018 Norwegian researchers found that Grindr was sharing users' health data with third parties, after which the app announced that it would end the practice.
• In 2021 The Norwegian Data Protection Authority fined Grindr a record 65 million kroner (about £4.8 million or 604.9 million rubles) for violating the GDPR. Grindr fought the case for years, but ultimately lost its appeal in a Norwegian court in 2024.
• In 2022 the UK regulator (ICO) issued the company with an official reprimand for failing to provide users with clear information about how their personal data was processed.

Such proceedings set a crucial precedent: intimate information on online platforms can no longer be thoughtlessly sold for advertising revenue, while protecting digital rights is becoming a matter not only of users' financial security, but also of their physical safety.