LGBTQ dating app Grindr will pay £26m to settle a group-action lawsuit alleging that it unlawfully shared users’ personal information, including HIV status, with third parties. The case is a reminder that data protection compliance not only a matter of avoiding regulatory scrutiny. Organisations must also consider the risk of large-scale claims from individuals alleging misuse of their personal information.
In this article, we break down the background of the case, the significance of the settlement and reflect on how the lawsuit may impact your business’ approach to data protection going forward.
What did the lawsuit relate to?
Grindr is a dating app which characterises itself as the largest social networking app in the world for gay, bisexual, transgender and queer people. The app boasts millions of users who can provide GPS data to see other nearby users, with whom they can then connect. Users can also share their HIV status (and when they were last tested), which Grindr says reduces stigma and allows users to make informed decisions.
In April 2024, a lawsuit was filed in the High Court of England and Wales against Grindr on behalf of around 12,000 UK users, alleging that Grindr had, over several years, unlawfully processed and shared highly sensitive information with third parties (including data analytics companies) regarding their HIV status and testing dates, as well as other personal information such as users’ ethnicity or sexual orientation. The users also alleged Grindr had received commercial benefits from parties with whom it had allegedly shared the data.
Grindr has previously been fined £8.6m in Norway over the sharing of personal data in 2021 and was reprimanded by the UK’s Information Commissioner’s Office in 2022 for failing to “provide effective and transparent privacy information to its UK data subjects in relation to the processing of their personal data”, in violation of the UK’s own GDPR.
Grindr disputed the new allegations, and the settlement filing to the US Securities and Exchange Commission relating to this case contains no finding or admission of liability. Grindr asserts that the lawsuit related to “historical data practices before 2020” when it was owned and controlled by the Chinese conglomerate Kunlun and that no users’ health information was shared for commercial purposes or otherwise monetised.
Grindr also states that since 2020 it has overhauled its privacy programme and is committed to transparency and responsible data practices.
Why does this matter for businesses?
As the case was settled before any High Court determination at trial, the lawsuit does not provide any direct legal precedent for how such data protection claims will be viewed by the courts going forward.
It does, however, demonstrate the exposure organisations may face where large numbers of individuals are affected by alleged data protection failings.
Historically, many businesses have viewed data protection risk primarily through the lens of regulatory enforcement. However, organisations face parallel risks, such as:
Individual compensation claims.
Group litigation involving large numbers of affected individuals.
Reputational damage arising from public allegations.
Increased scrutiny from customers, investors and other stakeholders.
The Grindr proceedings demonstrate how allegations concerning personal data can evolve into substantial group claims, even where the relevant processing activity occurred several years earlier.
The risk is particularly acute where organisations process special category data, such as information relating to health, sexual orientation or ethnicity. Under the UK GDPR and related Data Protection Act (DPA) 2018, such information attracts enhanced protection. Specific grounds are required for the processing of such data to be lawful, including explicit consent by the data subject, where information is processed in relation to legal claims, or where the information has manifestly been made public by the data subject themselves.
Reflections for UK businesses moving forward
UK businesses may wish to conduct several exercises in the wake of the lawsuit.
Reassess third-party data sharing arrangements
Many data protection incidents do not arise from deliberate misuse of information but from accidental disclosures under inappropriate arrangements with third parties.
Organisations should ensure they understand:
What personal data is being shared with third parties.
Why that sharing is necessary.
The specific legal basis relied upon under the UK GDPR and DPA.
Whether ongoing monitoring of third-party processing activities is taking place.
Particular care should be taken where analytics, advertising technology, artificial intelligence or data enrichment services are involved.
Review the handling of special category data
Businesses should consider whether they:
Process special category data.
Have identified the appropriate Article 9 UK GDPR condition for processing.
Minimise the collection of such data wherever possible.
Store data for a period no longer than is strictly necessary for the purposes that it is processed, and delete the data when appropriate.
Revisit consent and complaints mechanisms
A recurring theme in privacy enforcement actions and litigation is the adequacy of consent.
Organisations should consider whether consent requests are:
Clear and understandable – and if consent is given in a written document which also concerns other matters, then consider whether the request for consent is presented in a form that is distinguishable from the rest of the document.
Specific to each processing purpose.
Freely given.
Easy to withdraw at any time.
Properly evidenced.
We also note that the Data (Use and Access) Act (DUAA) 2025 has now come into force. This obligates businesses to provide customers with a clear way to complain about the handling of their personal data (eg, by providing a complaint form which can be completed electronically). It may be worth businesses reviewing their complaints process and ensuring that the procedure is adequate to comply with the DUAA’s requirements.
Prepare for complaints and disputes
With individuals becoming increasingly aware of their data protection rights in the wake of high-profile cases like this, as well as the ever-changing regulatory landscape, organisations should expect greater scrutiny of their data handling practices.
Effective complaint handling procedures can often resolve concerns before they escalate into regulatory complaints or legal claims.
Businesses should ensure that staff understand how to identify and escalate data protection concerns and that complaints are investigated promptly and documented appropriately. This may involve the obtaining of legal advice externally or ensuring that a firm’s in house team is adequacy trained and aware of all legislative or judicial changes relating to data protection.
If you have any questions or your business needs support in conducting any of the above measures, please get in touch with our specialist information, data protection and privacy law team.
Our content explained
Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.