The HIV field on a Grindr profile is optional, and the company's stated reason for having it is to reduce stigma and help users make informed health choices [10]. A user who fills it in has been told the disclosure serves them. What a team tells itself is that this is a feature with a health rationale. What the field also is, once it exists in the schema, is a property on a user record that goes wherever user records go.
The claim identified two data analytics services, Apptimize and Localytics, as third parties with access to the sensitive data [12], and alleged that a potentially unlimited number of third parties used it to customise advertising to users [13]. The sharing was reported in 2018, when Grindr defended the practice as in line with industry standards and then said it had stopped sending HIV data to those two providers [14][15].
The lag is the part worth staring at. Six years passed between that 2018 reporting and the High Court claim [20], and the settlement itself was reached on 2 September, according to Grindr's filing to the SEC [7]. Across the 11,000-plus claimants the law firm signed up, £26m works out at no more than about £2,360 a head before legal costs [18]. That is a concrete number for anyone inside a product org arguing against adding one more property to an outbound payload, and it is more use than a principle.
The person who answers for this is rarely the person who chose the SDK. It is whoever owns the schema now, which is the whole point of the pre-2020 framing: Grindr says the conduct belongs to the Kunlun era [6], and the cheque still clears from the balance sheet of the company that files with the SEC today.
The test worth running is unglamorous. List the fields a user can fill in that they would also mention to a doctor or hide from an employer. Against that, list every destination the profile record reaches, including analytics SDKs and warehouse syncs and anything an ad partner can read. Put sensitivity on one axis and destination count on the other. The fields sitting high on both are the ones still generating invoices six years on, and an overhaul of privacy practices dated to 2020 [17] does nothing about the payloads already sent.
