Grindr has agreed to pay £26 million to close a group action in the High Court of England and Wales, brought on behalf of roughly 12,000 UK users who alleged the app passed sensitive personal information — in some cases HIV status — to advertising companies before early 2020.
The resolution landed on 2 September 2026 and was disclosed to investors in a Form 8-K filed with the SEC on 4 September, signed by CFO John North. The Guardian reported the £26m headline number and claimant count on 7 September.
The deal in numbers
- Two instalments of £13.0 million each — due 31 December 2026 and 31 March 2027.
- About $17.6 million per instalment at the rate Grindr applied on 3 September 2026, or roughly $35.2 million total.
- Around 1.3% of Grindr’s current market capitalisation of $2.65 billion.
- Roughly 5.4x the 65 million kroner fine Norway’s regulator imposed over the same period.
- No findings and no admission of liability. Grindr continues to dispute the allegations.
The conduct predates the current owners. Grindr was sold to San Vicente Acquisition in 2020 for $608 million after a US national security panel flagged concerns over Chinese access to user data, then listed on the NYSE via SPAC in 2022 at a $2.1 billion valuation. The alleged practices happened under previous owner Kunlun — but the bill landed on the listed entity.
Why the App ID finding should worry media buyers
The most important precedent here is not the settlement — settlements set none. It is the Norwegian judgment covering the same window.
Norway’s data protection authority acted after complaints from the Norwegian Consumer Council and noyb in January 2020. The Oslo District Court upheld the fine on 1 July 2024, and the Borgarting Court of Appeal dismissed Grindr’s appeal on 21 October 2025.
The appeal court found disclosures ran from 20 July 2018 to 7 April 2020 and included advertising IDs, IP addresses, device specs, self-reported age and gender, GPS location and the App ID. Crucially, it held that the App ID alone revealed information about sexual orientation, because it showed a person was using the app at all.
Grindr worked with seven to ten advertising partners in that period. One, MoPub, had 160 partners of its own, including AppNexus — which reserved the right to onward-share with 4,000 more.
Read that chain again if you run app install or retargeting campaigns.
The takeaway: context creates sensitivity
Article 9 of the GDPR treats health data and data on sex life or sexual orientation as special category — prohibited by default unless a specific exemption sits on top of an Article 6 lawful basis. You do not need a field labelled “HIV status” to be inside Article 9. The source of the data can supply the inference, and the inference is what the law regulates.
The pattern repeats. Healthline settled a California consumer privacy case for $1.55 million after article titles referencing HIV and multiple sclerosis diagnoses were observed going to ad networks. A California data broker was fined $45,000 for selling lists organised by medical condition.
What to do this quarter
- Audit your SDKs. Tracking SDKs batch and ship device model, OS, locale, network type, IP and ad ID. Nothing in that payload flags sensitivity — you have to.
- Map the app-of-origin signal. If your source app or site implies a health, sexuality or religion inference, treat the identifier itself as special category.
- Test your consent flow. The Norwegian court found a take-it-or-leave-it privacy policy was not voluntary consent.
- Check onward sharing terms. Your DSP’s partner list is your exposure list.
- Price the tail. Conduct ended in 2020; the final payment falls in March 2027.
Private claims are the new enforcement engine
Regulator budgets and statutory caps limit fines. Collective actions do not. A £5 billion collective claim was certified against Google on behalf of UK search advertisers in August 2026; a Leipzig court awarded a Facebook user €5,000 for non-material damage.
Meanwhile the supply of consented sensitive data is shrinking — February 2026 research showed UK women increasing refusals to share identifying data by 3.19 percentage points and US women by 5.72.
Less consented data, higher cost for getting it wrong. That is the direction of travel.
Source: PPC Land
