Grindr to Pay £26 Million (~$35 Million) to Settle U.K. Claims Over HIV Status Data Sharing

Grindr agreed to pay £26 million (about $35 million) to settle a U.K. privacy lawsuit brought on behalf of more than 10,000 users (one source cites roughly 12,000) over alleged pre-2020 sharing of HIV status and other sensitive data with advertisers, with no…

Grindr has agreed to pay £26 million (about $35 million) to settle a U.K. lawsuit alleging it shared users' sensitive data — including HIV status and last HIV test date — with third parties for advertising before 2020, when the app was owned by Beijing Kunlun Tech. The settlement, disclosed in a September 2 SEC filing, includes no findings and no admission of liability, with £13 million due by December 31, 2026 and the remainder by March 31, 2027. The claim was brought by London firm Austen Hays; sources disagree on the claimant count, with The Hacker News reporting more than 10,000 and Malwarebytes Labs reporting roughly 12,000 U.K. users. Malwarebytes adds that the shared data may also have included ethnicity and PrEP use, and characterizes the period as ending in early 2020. The settlement follows Norwegian Data Protection Authority enforcement over ad sharing without a valid legal basis: Grindr was previously fined £8.6 million, reduced to £5.5 million under GDPR, a decision upheld on appeal last October (per The Hacker News).

• Settlement amount: £26 million, approximately $35 million (The Hacker News gives the USD figure as $35.1 million).
• Claimant count differs by source: more than 10,000 (The Hacker News) versus roughly 12,000 U.K. users (Malwarebytes Labs); the claim was brought by London firm Austen Hays.
• Alleged conduct: sharing users' sensitive data with third parties for advertising — HIV status and last HIV test date per both sources; possibly also ethnicity and PrEP use (Malwarebytes, characterized as may have included).
• Time period: before 2020 / ending in early 2020, while Grindr was owned by Beijing Kunlun Tech (described as China's Kunlun by The Hacker News).
• No findings and no admission of liability in the settlement (both sources).
• Payment schedule: £13 million due by December 31, 2026; the remainder — described by Malwarebytes as a second £13 million installment — due by March 31, 2027.
• Settlement disclosed in a September 2 SEC filing.
• Prior Norwegian DPA enforcement: Grindr was fined £8.6 million, reduced to £5.5 million, under GDPR over ad sharing without a valid legal basis; upheld on appeal last October (The Hacker News).