Threat Intelligence

Grindr to Pay £26 Million Over Alleged Sharing of Users' HIV Status Data

The Hacker News · 8 Sept 2026

Key Takeaway Businesses handling sensitive personal data should regularly audit which third parties receive user information and ensure contracts explicitly restrict its use beyond stated purposes.

Dating app Grindr will pay £26 million ($35.1 million) to settle a UK lawsuit alleging it shared users' personal information, including HIV status, with third-party advertising and analytics companies. The case, filed in April 2024 on behalf of more than 10,000 users, claimed the company breached UK privacy laws through its historical data practices.

According to a filing with the US Securities and Exchange Commission, Grindr said the settlement relates to data handling before 2020, when the company was owned by Chinese gaming firm Kunlun, prior to its sale to San Vicente Acquisition LLC. Grindr made no admission of liability but acknowledged the distress caused to affected UK users. The company says it has since overhauled its privacy program and committed to greater transparency and user control over data.

The issue traces back to 2018, when Norwegian research group SINTEF revealed Grindr had shared users' HIV status and last test date with third parties Apptimize and Localytics, which supported app optimisation. Grindr halted the practice at the time. Under the settlement, the company will pay £13 million by the end of 2026 and a further £13 million by March 2027.

data privacy Grindr data breach settlement third-party risk personal data

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.