Grindr to Pay £26M to Settle UK Suit Over Sharing of HIV-Status Data

Grindr has agreed to pay £26 million (about $35.1 million) to settle a class action lawsuit in the UK. The plaintiffs — more than 10,000 people — claimed that the app violated British privacy laws by sharing sensitive personal information, including data on HIV status, with third parties for commercial purposes such as advertising. The suit was filed in April 2024.

According to a filing submitted to the U.S. Securities and Exchange Commission on September 2, 2026, the California-based company settled the dispute, which concerned data-handling practices before 2020, when the platform was run by China's Kunlun. In May 2020, the service was sold to a group of investors, San Vicente Acquisition LLC.

The statement stresses that the settlement “contains no findings or admission of wrongdoing.” Grindr disputes the allegations but acknowledges the “concern and loss of trust” expressed by some of its British users over the pre-2020 period. The company points out that since 2020 it has overhauled its privacy protection program and remains a “safe space” for users.

The payments are split into two parts: £13 million by December 31, 2026, and another £13 million by March 31, 2027.

How it all began

The story dates back to April 2018, when the Norwegian nonprofit research organization SINTEF discovered that Grindr was passing data on users' HIV status and the date of their last test to two companies — Apptimize and Localytics — brought in to optimize the app. Grindr soon announced that it was ending the practice.

At the time, the company insisted that it had “never sold and would never sell” users' personal data — least of all information on HIV status — to advertisers or third parties. By its account, advertisers had no access to this information unless it was listed in a public profile, and Apptimize and Localytics used the data solely to service the app itself.

In January 2021, Norway's data protection regulator fined Grindr £8.6 million (the sum was later reduced to £5.5 million) for violating the GDPR by handing advertisers data on geolocation, sexual orientation, and mental health. The company challenged the ruling, but a Norwegian appeals court upheld the fine in October of last year.

Source: The Hacker News