Grindr is facing a class action lawsuit from hundreds of users over the sharing of HIV statuses and other sensitive personal information with third-party firms.
UK law firm Austen Hays filed the claim in the High Court in London yesterday, the firm announced. The class action "alleges the misuse of private information of thousands of affected UK Grindr users, including highly sensitive information about their HIV status and latest tested date," the law firm said.
The law firm said it has signed up over 670 potential class members and "is in discussions with thousands of other individuals who are interested in joining the claim." Austen Hays said that "claimants could receive thousands in damages" from Grindr, a gay dating app, if the case is successful.
Austen Hays alleges that Grindr violated UK data protection laws by sharing sensitive data for commercial purposes without users' consent, including when it "unlawfully processed and shared users' data with third parties, including advertising companies Localytics and Apptimize."
While Austen Hays describes Localytics and Apptimize as advertising firms, they do not seem to be in the business of selling ads. Localytics is software for mobile app marketing and analytics, while Apptimize says it provides A/B testing and feature release management for product teams.
AdvertisementGrindr admitted sharing HIV status, said it stopped
Grindr has admitted sharing HIV status with the firms but stressed that it wasn't for advertising purposes and pledged to stop sharing that information. The sharing of HIV status came to light in 2018 thanks to the work of independent researchers. At the time, Grindr said it "has never sold, nor will we ever sell, personal user information—especially information regarding HIV status or last test date—to third parties or advertisers."
Grindr said it "consult[ed] several international health organizations" before determining in 2016 that it would be "beneficial for the health and well-being of our community to give users the option to publish, at their discretion, their HIV status and their 'Last Tested Date' to their public profile."
Grindr acknowledged that it had been "sharing HIV status information with our trusted vendors, Apptimize and Localytics." Apptimize software helped Grindr test and deploy new app features including an "HIV Testing Reminder" feature, while Localytics software was used "to confirm that the new features were not causing problems with the functioning of the Grindr app," Grindr said.
Today, Grindr provided Ars with a statement in response to the lawsuit. "We are committed to protecting our users' data and complying with all applicable data privacy regulations, including in the UK," the company said. Grindr has never shared user-reported health information for 'commercial purposes' and has never monetized such information. We intend to respond vigorously to this claim, which appears to be based on a mischaracterization of practices from more than four years ago, prior to early 2020."
Law firm: Data about ethnicity and sex life also shared
Austen Hays says its lawsuit is about more than just HIV status information. The firm alleges that "information about the users' ethnicity and data relating to their sex life and/or sexual orientation may have also been shared." The "data breaches occurred mainly before 3 April 2018, and between 25 May 2018 and 7 April 2020, although they may extend to further periods," the law firm said.
In its 2018 statement, Grindr said that Apptimize and Localytics used HIV status and test-date information "only to provide services to Grindr."
"When working with these vendors, we restricted data shared to that which was appropriate for the services they are providing and encrypted it when providing it to the contractors," Grindr said at the time. "This data from HIV status fields was used to test and support development of a new features, like our recently released HIV Test Reminders."
Austen Hays hasn't submitted a detailed complaint yet but provided Ars with the claim form it filed in High Court. "The Claimants allege that, without their expectation, knowledge or consent, the Defendants deployed covert tracking technology within the Grindr App to collect and share various categories of personal data, including highly sensitive personal data, with third parties," the form says.
Grindr was punished by UK and Norway
The law firm's press release points to the fact that the UK Information Commissioner's Office (ICO) reprimanded Grindr in July 2022. The ICO found "that Grindr has failed to provide effective and transparent privacy information to its UK data subjects in relation to the processing of their personal data," the ruling said.
AdvertisementIP addresses and advertising IDs were a point of focus for the UK agency. "The ICO notes that Grindr does not consider IP address or advertising ID to constitute personal data. It is therefore not reflected as such within Grindr's privacy information. However, the ICO maintains that a data subject's IP address and advertising ID may constitute personal data in certain circumstances," the ruling said.
Grindr was also fined in December 2021 by the Norwegian Data Protection Authority, which found "that Grindr has disclosed user data to third parties for behavioural advertisement" without valid consent from users. "The data shared was GPS location, IP address, Advertising ID, age, gender, and the fact that the user in question was on Grindr. Users could be identified through the data shared, and the recipients could potentially further share the data," the ruling said.
The Norwegian Data Protection Authority fine amounting to about $6.2 million was upheld in September 2023 when an appeal from Grindr was rejected.
"Our clients have experienced significant distress over their highly sensitive and private information being shared without their consent, and many have suffered feelings of fear, embarrassment and anxiety as a result," Austen Hays lawyer Chaya Hanoomanjee said in the firm's announcement.
