Grindr settles £26m privacy lawsuit over HIV status data sharing

Grindr, the world's largest dating app for LGBTQ+ users, has agreed to pay £26 million to settle a lawsuit alleging it shared users' most sensitive personal information—including their HIV status—with third-party data analytics companies without consent. The settlement, announced on September 2, 2026, comes after more than two years of litigation in UK courts and follows a class action suit that eventually enrolled over 11,000 claimants. The company will make two equal payments of £13 million each, with the first due by the end of 2026 and the second by March 2027.

The lawsuit, brought by law firm Austen Hayes, centered on data practices that occurred before 2020, when Grindr was owned by Chinese firm Kunlun. The allegations were specific: the app had shared not only HIV status information but also data about users' ethnicity and sexual orientation with two data analytics services, Apptimize and Localytics, for commercial purposes. According to the claim, these third parties then used the data to customize advertisements targeted at Grindr's users—potentially reaching an unlimited number of downstream recipients. Chaya Hanoomanjee, the lawyer leading the case, stated that claimants had experienced significant distress over their sensitive and private information being shared without their knowledge or permission.

The practice itself became public in 2018 when revelations emerged that Grindr had been transmitting personal data, including HIV status, to those two analytics firms. At the time, the company defended the practice as standard within the industry, though it subsequently stopped sharing HIV data with those particular partners. The regulatory consequences followed: Norway's data protection authority fined Grindr £5.5 million, and in 2022, the UK Information Commissioner's Office reprimanded the company for its data handling practices. The settlement now represents a far larger financial reckoning.

Crucially, Grindr has not admitted liability. In a filing to the US Securities and Exchange Commission, the company stated it disputes the allegations while simultaneously acknowledging "the distress and loss of trust expressed by some of its UK users regarding that pre-2020 period." This formulation—accepting the emotional harm without conceding wrongdoing—is a common structure in privacy settlements, allowing both parties to claim partial victory. Grindr emphasized that the contested practices belong to a historical period and that the company has since undergone a comprehensive overhaul of its privacy systems.

The app's handling of HIV status data deserves particular attention because it reflects a genuine tension in how the platform operates. Grindr allows users to voluntarily disclose their HIV status and the date of their last test, framing this as a way to reduce stigma, enable meaningful conversation, and help users make informed health decisions. This opt-in feature is part of the app's stated mission to serve the LGBTQ+ community. Yet the lawsuit reveals how that same data, once collected, became a commodity—shared with commercial partners and used to build advertising profiles. For users who disclosed their status in good faith, believing it would remain within the app's ecosystem, the unauthorized sharing represented a profound breach of trust.

The settlement amount—£26 million—will be distributed among the 11,000-plus claimants, though the exact per-person figure has not been disclosed. The case itself represents one of the larger privacy actions brought against a social platform in the UK, reflecting both the scale of the alleged breach and the particular sensitivity of the data involved. For the LGBTQ+ community, privacy and data security carry heightened stakes; unauthorized disclosure of sexual orientation or HIV status can carry real-world consequences ranging from social stigma to employment discrimination to physical safety concerns.

Grindr's statement in its regulatory filing asserts that the company is now "a safe space for users, committed to transparency, user control, and responsible data practices." Whether that claim will be tested remains to be seen. The settlement closes one chapter but does not erase the years during which users' most intimate information was shared without their knowledge. For those 11,000 claimants, the payment represents acknowledgment of harm, even if the company stops short of admitting fault.