Researchers demonstrate ability to pinpoint users of Grindr, other gay dating apps with “colluding” trilateration attack
A few days ago, I warned my wife that the experiment I was about to engage in was entirely non-sexual, lest she glance over my shoulder at my iPhone.
Context & Ripple Effects
This 2016 demonstration is the opening move in a recurring finding: researchers showed that multiple free accounts could 'collude' to trilaterate a Grindr user's position from distance readings alone, no exploit needed. The same weakness family kept resurfacing — in 2019 researchers showed any user's location could be pulled via the public APIs of four dating apps given just a username (public-API location lookup), and by 2024 similar flaws across Badoo, Bumble, happn, Hinge and Hily allowed pinpointing to two meters before being patched (two-meter pinpointing flaws).
What makes the story durable rather than a one-off is who is exposed: for gay dating apps especially, precise location is a physical-safety issue, not a privacy nuisance. A 2020 study separately documented how Grindr, OkCupid, Tinder and period-tracking apps share intimate user data with brokers (intimate data shared with brokers), so the location attack sits on top of an already permissive data pipeline.
First-order effects
- Grindr users can be physically located by anyone willing to create a handful of colluding accounts, turning the app's core distance feature into a tracking tool.
- Grindr faces immediate pressure to degrade or hide distance precision — the direct countermeasure to trilateration — at the cost of product functionality.
Second-order effects
- Every dating app publishing relative distances or rich location APIs must re-audit its exposure, since the 2019 API findings showed the same class of leak extended beyond Grindr to other major apps.
- Security researchers gain a repeatable playbook: each disclosed method lowers the cost of the next test, which is why variants kept appearing through 2024 until fixes were shipped.
Third-order effects
- If the pattern holds, location fuzzing becomes a regulatory and design expectation for 'sensitive-context' apps — those serving LGBTQ users or health data — rather than an optional hardening step.
- Combined with documented broker-sharing of intimate data, these findings push dating platforms toward treating location and identity as high-risk assets throughout their pipelines, not just at the API surface.
The trend: Dating apps' location features have been shown exploitable again and again across a decade, steadily normalizing coarse-or-hidden distances as the default for any app where proximity reveals identity.