Grindr Pays $26 Million Over HIV Data Leak: What It Means

Dating app Grindr has agreed to pay 26 million euros to settle a class action lawsuit. The case was about sharing sensitive user data, including HIV status, with third parties. The settlement was reached in September 2025. It is one of the largest privacy payouts in the history of dating apps.

The lawsuit was filed in the United States. Users said Grindr shared their HIV status and last test date with two analytics companies. These companies were Apptimize and Localytics. Grindr also shared GPS location, email address and device identifiers. This happened between 2017 and 2020, according to court documents.

What the case was about

Grindr is the largest dating app for gay and bisexual men worldwide. The app has more than 13 million monthly users. Since 2016, users could add their HIV status to their profile. They could also add their last test date. Many users did this to be open with potential partners.

In 2018, the news site BuzzFeed News reported that Grindr shared this data with outside firms. The report was based on research by the Norwegian group SINTEF. Grindr said at the time that the data was only used to improve the app. The company also said the data was not sold.

Still, users filed a class action. They said Grindr broke privacy rules by sharing health data without clear consent. HIV status counts as sensitive health information under most privacy laws. This includes the European GDPR and California's Consumer Privacy Act.

The settlement

Grindr did not admit guilt in the settlement. The company agreed to pay 26 million euros (about 28 million US dollars). The money will be split among users who joined the class action. Lawyers estimate that eligible users will receive between 50 and a few hundred euros each. The exact amount depends on how many users file a claim.

Grindr also agreed to change how it handles health data. The company stopped sharing HIV status with third parties in 2018, after the BuzzFeed report. In a statement, Grindr said: "We are pleased to resolve this matter. User privacy is a core part of our platform."

Earlier fine in Norway

This is not the first time Grindr has been fined for privacy problems. In 2021, the Norwegian Data Protection Authority fined the company 6.5 million euros. That case was also about sharing user data with advertisers without proper consent. The Norwegian watchdog said Grindr broke the GDPR.

Grindr appealed the fine. In 2023, a Norwegian court confirmed the fine, but lowered it slightly. The case set an important example for dating apps in Europe. It made clear that sexual orientation is protected data under the GDPR.

Why HIV data is different

Under most privacy laws, health data gets extra protection. This includes HIV status, mental health information and other medical data. Companies need clear, specific consent to process this data. A general privacy policy is not enough.

Sharing HIV status can have serious consequences for users. It can lead to discrimination at work, in housing or in relationships. In some countries, HIV-positive people still face legal problems. For example, some countries have laws that criminalise not disclosing HIV status to a partner. This makes data leaks especially risky.

The UNAIDS agency has warned dating apps about this issue. In a 2019 report, UNAIDS said apps must be very careful with HIV data. The agency called for stronger technical protection and clear user information.

What users can do

Users who were active on Grindr between 2017 and 2020 may be able to file a claim. The settlement website will open in the coming months. Users need to prove they had an account during that period. They do not need to prove they added HIV status to their profile.

Privacy experts advise users to check the privacy settings on all dating apps. Most apps allow users to hide health data or limit what is shared. Users can also ask apps to delete their data under the GDPR. This right applies to anyone in the European Union.

Wider impact on dating apps

The Grindr settlement is being watched closely by other dating apps. Companies like Tinder, Bumble and Hinge also collect large amounts of personal data. Some apps ask users about sexual orientation, drug use and other sensitive topics. The Grindr case shows that regulators and courts take this data seriously.

In Europe, the GDPR gives users strong rights. Users can ask what data a company has about them. They can also ask for their data to be deleted. Companies that break the rules can be fined up to 4 percent of their global revenue.

In the United States, privacy rules are more fragmented. California has strict rules under the CCPA. Other states have weaker laws or none at all. Federal privacy legislation has been discussed in Congress for years but has not passed.

The settlement is also relevant for people who use apps to find health information. Related legal questions have come up in asylum cases, where dating app data has sometimes been used as evidence. Similar concerns played a role in earlier European rulings on family rights and personal data.

What comes next

The Grindr settlement still needs final approval from a US federal judge. This is expected in early 2026. After approval, eligible users will get information on how to file a claim. The deadline to file will likely be several months after approval.

Grindr has said it will keep investing in privacy protection. The company hired a new chief privacy officer in 2024. It also introduced new security features, including end-to-end encryption for messages. Whether these steps are enough remains to be seen.